It may not phone home now, but it can do it tomorrow, or it can in be enabled and immediately disabled in some minor releases.
Even if people didn't catch those shenanigans immediately it will be evident from the commit history. I'd say opensource forces certain discipline.
Also there is point of rugpull, or the product is getting cancelled. Few people will step up to maintain it; atleast until most users migrate to a different product.