There have been instances of open-source programs (including a certain code editor Hackernews has a collective nerdgasm over every time a release drops) shipping with telemetry or other spying features enabled. In some cases (like that one popular browser), the vendor makes it difficult or impossible to disable those features without modifying and recompiling the code.