There is a difference between serverside and client side here. Since your talking about scrollbars and markdown editors I assume this is client side. I would be less concerned with client side problems, since most modern browsers pick up on security issues fast. In addition to that, browsers try to limit security risks, and sometimes act on the behalf of the user (malware detected, invalid xhr requests).
Backdoors are rather uncommon for these libraries or any piece of client side software. Thought they do exist, HTML5 and the modern web have driven browsers to implemented some tricks to prevent malicious activities, for example; same origin, mixed content, popup blocks and iframe warnings, the remove of flash, activex and applets, and so on...
Serverside is an other story. If you use third party libraries (whether they are opensource or not) you expose the environment in which the application runs. Often employed techniques such as jailing, autdits, permissions per application directory and per database (operation) minimize the chance of successfully corrupt/access data and/or other environment data.
To answer the question, it is a legitimate problem that can cause catastrophic failure. It is not easy/impossible to check every piece of code you just. Nowadays frameworks depend greatly on plugins, extensions and libraries. Opensource does not equal fast security fixes, but we may assume the more people use something, the faster bugs are reported and fixed. Put systems in place to limit the possibilities when it does go wrong. Have a disaster plan, design for failure, use (audit)logs, have daemons crawl the accesslogs and so on. When it comes to backdoor, people often seem to forget the outgoing firewall.