Most of his well-known projects have public git repositories that you can clone, inspect, and contribute to.

if these projects have any value, someone will clone them to a public repository.

While introducing minor changes to the build system scripts, you mean?

i'll take any publicly visible build system over a hidden one

Nothing here was ever hidden.

all of Fabrice Bellard's projects are primarily available as tarballs from their website.

definitely more hidden than a public git repo. and allows for xz style backdoors without being able to investigate them after the fact.

I don't see what point you're trying to make. For me a tarball is at least as public as a "public git repo" (whatever that means). In fact I would argue a git repository allows for way more opportunities for obfuscation, seeing that it is a much more complex format.