It's absolutely true in principle that if you think someone is malicious, you shouldn't use anything they give you, source or binary. However, important things happen on the margins of how you find out there's malice. Information security is one of those mirage games where attacker and defender are each trying to guess how much effort it's worth to the other party and then be gratuitous and extra about their own stuff so the other's efforts will be wasted.