It's not as heavily audited as you think. They have like a dozen active developers.

How many developers do you need (and trust) to review patches?

They only audit the kernel and base userland. Ports are subject to far less scrutiny.