If the software is open source then it is only vulnerable to people installing exploits in it if nobody audits it. People will always be able to steal bitcoins in their possession so I don't see how having a secure mix is any different from having a less secure mix in that respect. They guarantee it based on the way the math works, the client gets an IOU saying that they are owed 1 bitcoin for every bitcoin they send to the server, and then they can do a mathematic proof that shows the server can not identify the signature on the IOU it just sent them. However, the server can still verify the signature on the IOU when presented with it, and then it knows that it actually owes the person with the IOU 1 bitcoin. However, it can not link the person taking the bitcoin out to the person who put the bitcoin in. If the client software is open source and people audit it, there is not much risk of a backdoor being put in...in fact blind mixing software is pretty simple to make and wouldn't entail very much code at all. Please let me know when you do better than mathematically ensured unlinkability of signatures to clients.