How can I ensure that some OS can be trusted? I'm not speaking about possible security problems which can happen everywhere but about something like a backdoor left by a developer. Can such a thing occur (Or had they occured) in Windows, or in most popular linux distros like Debian/Fedora/Arch/Ubuntu/Gentoo?
There are two ways: inspect every line of code, or build your own OS. Not only the OS, but all the libraries, the compiler, everything that touches your source code.
A backdoor can be deployed? Yes. But on any open source OS (Linux, OpenBSD, Plan9 et al) any backdoor can be detected by other programmers, the same cannot be told about closed sourced OS (Windows and MacOS came to mind).
It's relatively easy to check the development history of an open-source operating system, on github or elsewhere. If there are more than a few developers, and they are working under their real names, then you don't have to audit each line of code; you already know that each line of code has already been audited before it gets put into the "official" codebase. You can probably compile from source if you study the docs.
Yes, it is possible to hide backdoors and malware in software where the code is open to scrutiny; there are even software writing contests based on exactly that. (See the Underhanded C Contest in wikipedia.) However, "underhanded" code is necessarily spaghetti-ish and violates good SDLC practices; open-source software is necessarily optimized for readability and maintainability. Nobody would be allowed to put a machine code snippet in a C constant, for example, in a commercial software product; much less in an open-source community project.
Also, don't underestimate how difficult it is to write and deploy malicious code that actually works as intended. Just because an exploitable attack vector theoretically exists, and has been documented in a bug report somewhere, doesn't mean somebody has actually spent the development hours necessary to exploit that bug in a way that is both scalable, and undetectable to the user. Much less, undetectable to fellow developers.
And besides, open-source software is less vulnerable to malware and remote-code execution exploits, simply because of the variety of distros; it's harder to create malware for them. If you use a linux variant, and accidentally encounter a malicious attachment or some sort of drive-by download, it will almost certainly be a Windows executable. You will laugh out loud and simply delete it.
TLDR: Don't be paranoid... you can trust any half-way respectable open source project.