FOSS is only reliable if it is maintained and has an active community. With FOSS that hasn’t had updates in years, as sometimes found on GitHub, Gitlab and others, you have to take it with a grain of salt. We must not forget that being open source, it is also easy for malicious actors to discover security holes or inject some malware, which in a software that lacks supervision or is abandoned is not discovered. Although it is true that FOSS is usually quite secure, it is not carved in stone and you always have to be careful, as with any other software. Security and privacy always depends on the dev or the company, it’s irrelevant if it is FOSS or not. The APIs to track userdata and log its activity from Google, Amazon, Fakebook and others, are all FOSS.