I would like to point out that they are free to modify the source code before building the binary they distribute. Being open source does not mean protection from secretly stealing data.

With chrome it is obvious because the closed part is called chrome and the open is chromium. But it is certainly possible to not make “stealing” magic on top public.

https://archive.is/77f3S

Because you can does not mean you should.