These projects are so incomprehensibly vast that no human mind can comprehend even one small isolated subset of the entire thing.
Which means - no human mind can trust them either, and no human programmer alone can conduct a security review.
Which means they should not be trusted, and should be considered insecure - unless they can be carefully isolated from the environment so that only a trusted surface is exposed.
My ideal project size: something that an average coder can read in a week or two, and come back to their (possibly anarchist) colleagues saying: "this code looks reliable and won't be leaking buckets".