Anyway we could run some scans of the N900?

I question whether being open source is great protection against malware.

Have you gone through the source code of all the apps on your phone? I doubt 2% has been examined by anyone for malware.

It would not be difficult to obfuscate injurious functions even in source code, especially with the code bloat that present-day SDK's bring with them. Glazing over after following execution across numerous functions across even a few files, it would be easy to overlook a quick malicious act.

Some day, someone may trip across something, but odds are a bright programmer would be able to be long over the horizon by then.

One has to be careful about what one installs, period. Before installing a program, on any OS, I have a look at who is the creator, what reputation does he/she/it have, etc. If it is a copylefted program then I am much more trusting and generally feel very safe installing it. If it is closed source, I am much more skeptical and careful.

Like rm42 said, open source is certainly not a cure-all for preventing malicious software. But you can't deny that it helps.