The patch is totally open source, and the project is rather high profile. Where exactly is the additional risk here?

From a security standpoint, What's the difference between using revanced's open source patches and downloading literally any open source software from GitHub?