That's EXACTLY my point. That's why no closed source coin can ever be trustless.
I don't get it. Why would open-source be a requirement of trustless anonymity? If it works then it works, which the audit will determine.
It's really not that complicated. If you have to trust someone/-thing, it's not trustless. Even if the auditor would declare the current code "trustless", you still would have to trust his judgement and honesty, and also trust the devs to not introduce new flaws(or even intentional backdoors) into the code with a later update. That's why open source is so important in the crypto community.