Best to do both. Look at the code and the connection. And if one is shady put even more eyes on the other. Only relying on one data point is stupid. Compromise can come in different flavours.

As explained earlier, it is darn easy to hide anything inside 25 million lines of code, whereas it is easier to ask who is sponsoring a project. Past experience like Signal and its gov-sponsoring has demonstrated that it is a good practice to follow the money trail when the topic is privacy.