By definition, what you add to a copylefted piece of free software must be
distributed under the same free software license. So anybody can read what
was added (freedom 1) and that would be completely fool for a company to add
a malware. Just imagine its reputation once someone discovers it (by simply
reading the source code).
With permissive licenses (such as the Apache license), you can redistribute
the whole under a proprietary license. With no access to the source code.
That is what t3g is promoting. And in this situation, you simply cannot tell
what was added. It may be a spyware, a backdoor, etc. Only the developer
knows and ends up with an unethical power over the users, who are those who
achieve their work through the software.
That said, it is indeed safer to stick to what the repositories offer. Small
unknown free applications have usually been only read by their authors. That
is why there is a risk. Far smaller than in the case of proprietary software.
But a risk anyway.
