While the code being open is good you still have to rely on trust.

I certainly don’t have the time to review to code of each extension I use. And even then, we have no garanties that the extension distributed through the browser stores has the same code.

You can see the issue was opened on august 18th but the responsible commit was only made on the 19th. So the code was pushed the extension users before it was made available on the repository. Open code is of no help here.