Yes you are right, but with open source it is more unlikely than with closed source downloads. And everyone has to decide for himself, if he want to let his data completely open (just because there could be malware, anyway).