> at one extreme you have people who can audit software they use and verify that it actually does what it says

Unless the software sends data off to the cloud or a sever somewhere. You can't audit what happens there.

I was referring to the acuity of potential users, who like you, would be able to identify that.