I've some questions about Ghidra released by NSA on Github. And research about it then saw a ycombinator thread for it. That answer was clever and funny.
As title marked, you really okay for just "open source" to trust it?
Even if we take your definitions, they are still conflicting.
Attacking humans means developing malware.
Defending capital means protecting that capital from others malware.
If either of them do their job too well, the other will be failed. That is by definition conflicting.