Tor has been compromised on occasion but my OP was not about TOR, it's about the irrelevance of free software provenance.