There’s a big difference between executing something from your package manager—and bluez is packaged by literally every major distribution—and executing:

a random binary from a brand new GitHub repo (which you didn’t build and can be swapped out for something evil any time)

…that’s actually a different project’s binary rebuilt and renamed/redistributed (or malware)

…as root

…on a hypervisor.

So yes,

> It's always about trust in author and distributor

Is totally correct. There are different levels of trust. This repo merits very low trust.