Security-wise: closed-source tech giant app vs FOSS of a single developer

[Iluvinatum]

I read a thread from recommendations

Does anyone check the code of FOSS apps? How do I know?

Open source means that the code is available for security evaluation, not that it necessarily has been evaluated by anyone. This is an important distinction. Understood. My question is, how do I know if it has been evaluated by anyone. And when somebody evaluates the code, and finds a problem, is Github the place where it will be reported?

It seems I should better lean to tech giants or highly popular FOSS with many eyes watching. So the chance someone indeed cares about security is higher. At least making sure that libraries with severe CVEs are updated.
AmazeFileManager looks like one I can trust.

Regarding threat model, I consider remote attacks, not physical access. I skip apps with no updates for >1y, simply to “stay updated”. I don’t know technicalities of it, just follow general safety recommendations like this. Exploits can be bizarre and you would never guess it’s even possible to hack this with that.