Think 'safe' is an oxymoron whether it is Unix, Linux, BSD or any other software distribution. The reason being, you are trusting other people with data. While I have been using Debian for around 10+ years without a major issue, there were a couple of problematic packages, but it was outside the distributor's control or knowledge. This is of few years ago, I do not remember the name of the package, but I do remember somewhat the functionality of the package.
This was before Firefox moved to this aggressive release process where it would have support for an addon n number of years. The package or addon was about checking security of a webpage/website. As we all know any site certificate involves number of things. And you would want to check the cipher strength of the certificate and the various things to know how good or bad that site is on security. Something similar to https://github.com/andreicristianpetcu/Base64CertificateViewer/ which I'm using atm. The only difference was that add-on was selling data (IP of the user using the addon, which sites the user was going to, etc. etc.) to a third-party or third-parties. People came to know about it almost 5-6 years afer the fact. There was lot of drama and at the end the add-on was taken off firefox store/addon page and they also did lot of changes to how much can an external addon view and show the certificate.
FWIW, the moment it was known, it was also removed from Debian's repository but the damage was done. I was the original requestor to ask for that package to be in Debian. And I did know that quite a few people who use Debian are in vulnerable position while some in powerful positions. If either of those groups used that addon from the repo. they made themselves more vulnerable.
Now such kind of data thefts, I doubt any store or anybody can predict. There have been similar such instances in many areas. For e.g. the drama at Freenode,
As far as social dynamics are concerned, you can't rule anything or anybody out.
Free software does attempt for people to do the right thing. Almost all software comes with one or more licenses and most were written with a specific need at a specific point in time. Most of these licenses need to add, modify the licenses so its add the data protections that we want also. The good news is, this can be done as most foss licenses are also hacky, the bad news is if there is a bad actor he may ignore the license one way or the other.