>"I'd not trust them to actually give you the complete real deal and there's no way whatsoever to validate that the code they release is really it."
Oh, you mean kinda like Chrome?
You know, that popular browser by Google.... the one that is binary and you don't really know what they are doing. They release the code as Chromium. And don't really let the community steer it in any meaningful way, they have 100% control over the code. Then they take it and do mysterious stuff on/in it and produce a binary that people run.
So yeah, run Firefox, where you can compile it yourself, or run a trusted binary by a third party, or run a fork like LibreWolf, Waterfox, or Palemoon.
At least what X is doing is a zillion times more transparent than what Twitter was doing. And infinitely more transparent than Facebook, YouTube, Instagram, LinkedIn, Shapchat, Pinterest, Threads, Discord, Twitch, or TikTok. And they promise they will accept feedback and will be releasing more code as open.
I proudly have never even had an account on any of those. (Technically my Android account is an account on YouTube, but I have never used YouTube as "logged in"). I suppose Slashdot is the closest I have ever come to "social media."