But then you have to trust, 1, the auditors (I assume by your comment you mean the people given closed door access to the code, reviews it, then publishes a statement saying their claims are valid, that kind of third party auditing?); 2, the code they disclosed to the auditors is the actual complete codebase; 3, that between the current version and the next they did not add anything fishy; and last but not least, 4, the binaries they give you is actually built from that codebase and nothing else, since you can't build it yourself if you're really that worried.

I don't fully disagree that you can have a private and secure third party app, sure you can, but I argue that there are some really big hurdles and you can never have 100% trust in it. Whether these things is a dealbreaker depends on your own values, opinions, and threat model, of course.

I suppose you can also decompile it and analyze it that way, but that's very difficult and compared to reviewing an open source app, pretty much no one is going to do it. You also don't have the same level of community attention and contribution as an open source project where people are forking it, sending pull requests, and going through the codebase to learn how it's implemented in order to develop their own projects, all of which gives many opportunities for other developers, usually ones very concerned about privacy and security themselves, to notice and sound the alarm on unethical or insecure code in the app.