> Do you trust facebook (excuse me, meta) to not snoop on your messages

No, but I trust some nosy German guy at TU Whatever to spend hours poking at the assembly, find that hidden flag and proudly present it at 40C3.

With enough eyeballs, all source is open (and AI will give us far more eyeballs than we have any idea what to do with).

Sure, you can have different builds distributed to different people, but the NSA can also just do that with Signal, Signal being open source makes it that much easier. FDroid mitigates this somewhat, but it's not like the NSA can't get a fake TLS certificate for their domain and MITM your communications.