You're putting a lot of faith in whoever packages the 'distro'.
Obviously you have the same problem with trusting FOSS software distributions, but it's mitigated by things like Linus' Law and reproducible builds.
That being said, I personally use tiny11 VMs for certain non-critical things at home and work. I'd never use it for anything security related, or as my main OS, as there is a non-negligible chance that it's compromised (and there's basically no way of knowing).
I live in a country with a nominally 'labor' government that has stood in the way of unions protesting the genocide in Gaza and is actively working to suppress union led protests.
We in the west are in for a very rude shock in the coming years. Today it's clamping down on protests for Palestine, tomorrow its teargas and truncheons for strikers.
A lot of people don't understand that if we don't stand up for the Palestinians, we won't have a snowballs chance when it comes to seriously protesting our own governments and the corporations that control them.