How many developers do you need (and trust) to review patches?

They only audit the kernel and base userland. Ports are subject to far less scrutiny.

The point of the GPs comment wasn’t that there isn’t enough developers. It was that the OPs comment of “most heavily audited code bases” was an exaggeration.