Even larger open-source projects aren't immune. FileZilla has had an issue of adware a few times. I don't think there's any way to ensure that an application of any sort will remain trustworthy.
As it happens, earlier this year I came to the conclusion that browser extensions are too high-risk, and I disabled everything I could possibly do without. Now I'm limiting myself to just Firefox "recommended" extensions, under the hope that Mozilla is doing something to make sure they stay aboveboard, and a few non-recommended ones that I just can't live without, like Vimium. I lost some functionality due to disabling extensions, but so be it. The browser is far too important these days.
For my remaining non-recommended extensions, all of which are open source I think, I am considering some workflow where I just clone their repos and install the extensions locally, updating occasionally when I can review the resulting changes myself.
(It happens that I had disabled Nano Blocker in my purge months back. FWIW it never seemed to work for me. For those uninstalling, don't forget to uninstall the extension, the block lists, and the uBlock advanced "user resources" file.)
EDIT: Just realized I can turn off automatic updates for just some Firefox add-ons, so I did that for a bunch of add-ons. I'll update them when something breaks and I have time to review what's changing.
Now I have to delete stuff.
At this point, I no longer trust non-open source application and even open source stuff with low followers.