These projects are so incomprehensibly vast that no human mind can comprehend even one small isolated subset of the entire thing.

Which means - no human mind can trust them either, and no human programmer alone can conduct a security review.

Which means they should not be trusted, and should be considered insecure - unless they can be carefully isolated from the environment so that only a trusted surface is exposed.

My ideal project size: something that an average coder can read in a week or two, and come back to their (possibly anarchist) colleagues saying: “this code looks reliable and won’t be leaking buckets”.