I've some questions about Ghidra released by NSA on Github. And research about it then saw a ycombinator thread for it. That answer was clever and funny.
As title marked, you really okay for just "open source" to trust it?
Also just want to add to your points that the NSA didn't have to admit they developed this. Putting their name to it basically guaranteed that everyone would pour through the code and assume the worst. So it get hyper scrutinzed. So if they had wanted to put a back door in it they would have released it without saying they made it.