It depends on how you got make/gcc/etc. in the first place. I'm going to assume that you got an "official" copy and verified its signature (which is automatically done if you use a package managemement system, like apt for example).

So someone would have to push a malicious change to the compiler codebase and have that change go through the 100s of pairs of eyes that monitor the code without anybody noticing. That's very unlikely and, to be honest, less probable than having a bug (malicious or not) in the monero codebase.

In the end, you could have malicious code running on your hardware, in your OS, in the compiler etc.: you always have to trust someone...

It depends on how you got make/gcc/etc. in the first place. I'm going to assume that you got an "official" copy and verified its signature (which is automatically done if you use a package managemement system, like apt for example).

So someone would have to push a malicious change to the compiler codebase and have that change go through the 100s of pairs of eyes that monitor the code without anybody noticing. That's very unlikely and, to be honest, less probable than having a bug (malicious or not) in the monero codebase.

In the end, you could have malicious code running on your hardware, in your OS, in the compiler etc.: you always have to trust someone...