> I'm pretty sure that several GNU/Linux repos contain the version of Unity that pinged Amazon's servers to name an example.

FLOSS does not prevent malware from existing, but it makes it highly unprobable. You can always find bad examples, but how frequent are they?