It is always possible. The point is that while open source software doesn’t solve this problem, it gives you a non-zero chance of someone detecting it and raising the alarm. Non-zero may be large or may be small, it is probably never 100% chance, but large non-zero is very good, and even small non-zero it is much better than the 0% detection chance that closed source offers.