Great question!
I have looked at processes and like you its very hard to tell what is what – Im guessing people with more knowledge would of cracked this right open if some of the “named players” in the game were adding malware and backdoors – it did happen once with a Hyperspin drive seller, had a keylogger attached to it and remote sender, so would log all keys and upload the log files.
I guess like anything we get for nothing, its a small risk we take, although I do honestly believe there are some 'nix guys that do check every image they download and by now would be blown open and the image releaser named and shamed.
My Pi images are plugged into a network for a while for me to make some joystick configuration modifications and maybe change some loading screens/videos to suit me, then unplugged never to be “networked” again.