[rloc]

Yes.

Xcode was hacked not so long ago. The malware could remain invisible even to the creators of the app. Although it's less likely to remain unnoticed with open source projects due to the visible nature of it.

On desktop, Mac OS and Windows now provides official stores where apps are verified and signed.

On Android I remember Google added an app scanner in order to detect infected apps even when the security setting is disabled. On windows there is defender.

At the end of the day it's all about trust. Be very careful regarding where you download the software from.