Security experts have pointed time and time again issues with their build infrastructure.

But to be fair, they use developer builds if they are reproduceable (most are not). They will reject publication if non-free software is used though.