Sure but the fact that anyone there could do it means fundamentally there is a risk present and that’s a bad position for a privacy centered organization. The others there MAY not do it, but they COULD.

If the recent drama with the former lead dev of GrapheneOS is any indication, putting our trust in a singular entity in charge of custom ROMs is also risky.