Your words, not mine. If they were afraid of malicious code coming from these sources they would’ve removed them earlier and not only after their legal department recommend these maintainers be removed.

Open source doesn’t mean that malicious code isn’t impossible though. For a project as large as the Linux kernel it is unlikely, but see the xz-utils incident earlier this year for example. https://en.wikipedia.org/wiki/XZ_Utils_backdoor