Backdoor detection is an unsolvable problem both in theory and in practice. We are talking about carefully hidden obfuscated backdoors in MLOC codebases, which will have unexplained binaries and arcane build scripts. No company, not even Google, can guarantee that they'll be able to catch every backdoor hidden in some arbitrary codebase.

The only practical solution is for these companies to rewrite the core packages from scratch, written from the ground up so that they are easy to audit - no unexplained binaries, no arcane build scripts, etc.