The example of a trojan that you give is a good reminder of what we can do as counterarguments when we are pressured to install non-free software, or even worse, non-free binaries, on our computers. As you point out, it's trival to insert a trojan in code.

Free-licensed code tends to be safer, because it's more likely, though not guaranteed, that people notice security flaws.

Free-licensed code in a git repository by identified scientists from your own scientific community tends to be even safer, because the dangerous part of the code would be traceable in the git history, and if it became clear that the flaw were deliberate, then that would be quite bad for the author's reputation. There's also no motivation for scientists to do this, where your informal scientific reputation is de facto important, even if it doesn't count in bibliometry.

Regarding the text of the warning, shifting the source URLs to a single file will be useful in this context - see https://savannah.nongnu.org/task/?15686 . Once this is done, we should recommend that the user browse through the list of URLs and make a judgment regarding how much s/he trusts those URLs to provide secure software.

There are several overlapping en.Wikipedia pages describing various forms of trust networks for software/computing/internet:

https://en.wikipedia.org/wiki/Trust#Computing

Debian effectively has a trust network in the sense of multiple pipelines for submitting software updates, a formally developed trust network of Debian Developers, together with bug reports and so on, plus a dedicated security team.

This suggests one way of increasing security, which will be easier when 15686 is implemented, which will be to have an option to preferentially use GNU and Debian sources as much as possible: so rather than strictly upstream sources, these will be quality controlled versions.