How can we trust the image if we don't know what is inside? An sbom says what packages are installed but what is in the packages? Alpine/debian packages show y

How can we trust the image if we don't know what is inside? An sbom says what packages are installed but what is in the packages? Alpine/debian packages show you the code that compiles the package from source, do you have that as well?