In the decades that open-source projects have existed on GitHub—even those backed by the Chinese government—there has never been an instance of them containing spyware; conversely, we frequently see NSA hacking tools exploiting open-source projects to launch massive cyberattacks and cause data breaches. Reality isn't like American movies where Americans are always the heroes; in fact, those GIs are usually the ones doing the invading. To me, your statement sounds like a resident living under Nazi rule telling everyone, "There's actually a pretty good project over on the Allied side—if you choose to believe it."