Comment by xKingfisher

There is more than just hope to rely on.

Diverse Double-Compiling[0] can provably detect this class of attack.

[0]https://dwheeler.com/trusting-trust/