But even if they are open-source, I reckon that 90% of users don't know how to check and verify the legitimacy of the code.
It's not just the checking and the verification of the legitimacy of the code. You shouldn't forget; since it's open-source, the other applications' developers can read its code and update their apps in a way that they interact with the open-source one.
You have to ensure that your machine is clean. If it has caught anything weird, it's recommended to not move/sign anything. Even if you've downloaded from the correct website and verified the developer's signature.
