Because its not realistic to do actual proper due diligence for this. Take the PHP fix from yesterday, I did not read the source of what they actually fixed, nor do i have the ability to understand it. I still installed it in my org because I have trust in the system that created it.

Its similar with apple, I have the reasonable assumption that whatever I install from the app store is not going to brick my phone, steal my data or be a giant resource hog that just runs in the background.