Any intentional malware injected into open source software by the same people who are developing them may eventually get known as the source code is open to the public. However, if the code base is large, average people dont have the time and resources to go through it and hence it is possible for such malware to remain undetected for a long time. Hence it is important to develop independent agencies to regularly scrutinize changes to the software. Do such agencies exist and are they reliable?
There is no simple or single answer to the question.
Do individual projects get reviewed by independent agencies? Yes. Here is an instance of Mozilla hiring such an agency.
Are those agencies reliable? That's an impossible question to answer since the question has no scope.
However, there are numerous independent researchers who comb through code hoping to find errors and mistakes so that they can get recognition. It's that cloud of independent testers that really helps to shine a light on open source code.
Remember that reviewers do not need to review the entire codebase regularly. All they need to do is to review the patches as they come out, for that is the code that changes.