There is no way to prove that a closed source app is not compromised. Even if in the past didn't do anything wrong, we cannot prove that in the future it won't. With open source build-reproducible apps (using gpg and hashes) we can. Because we know what we are executing.