Do people just trust such services?
Basically it boils down to trust. There is no magic oracle which is able to tell you for sure if a complex software is secure or not - no matter if closed source or open source.
With open source there is trust that nobody will hide a backdoor in the software, based on the believe that it will be easily detected. This believe could be wrong since a well-designed backdoor might not be actually distinguishable from a bug. Often there is also trust that there will be less bugs since "everybody can audit and fix the code". But in reality this is far less done then would be useful since such audits are costly (might not directly take money but time and knowledge, i.e. opportunity costs) and as a result there are still many and also critical bugs found in open source software which were in the software for many years. There is also usually trust that a downloaded binary will actually reflect the published source code, i.e. one could in theory build it from scratch. But rarely someone actually verifies this believe.
With closed source it is mainly about trust too. It is trust in a good track record of a specific company. It is trust that a company has an interest to provide secure software, at least in case their business model is build around such reputation. There is trust in the companies marketing.
In more security sensitive environments more is needed than just trusting the vendors marketing (closed source) or having the theoretic ability (but usually not the knowledge and/or time) to thoroughly inspect the source code (open source). In these cases additional trust factors might help, like in the form of external certifications. There are companies who specialize in auditing software both in design and implementation, in doing penetration tests etc. If independent companies with a good reputation verify the software and design and assure that it is fine, then this is usually more accepted than just the claims of the vendor themselves.