So far the answer is:
Some checks to vet the risk:
- Has been updated in last few months (maintained)
- Developer has resources to debug
- Big Organisation where reputation loss is an issue
- Reviews do not mention security issues
If no to any of these, then don't use the app.
Project/developer has reviewers/Large, popular open source app across multiple platforms
- This may be ok but I'm unsure if that works, as it depends if the code is reviewed.