Basically this. Also even if something is open source and doesn't *look* shady, that doesn't mean there's not an intentional backdoor or vulnerability obscured somewhere in the code. Just prevents and obvious one from existing.