It's not as heavily audited as you think. They have like a dozen active developers.
How many developers do you need (and trust) to review patches?
They only audit the kernel and base userland. Ports are subject to far less scrutiny.
alt Hacker News
How many developers do you need (and trust) to review patches?
They only audit the kernel and base userland. Ports are subject to far less scrutiny.