And yes, the binaries *could* be totally bad and evil... but the sources look clean... and this is true of pretty much ANY wallet software... BTC, BCH, ETH etc... There is a lot of fear and FUD floating around...
At the end of the day... if you want your BCH, you are going to have to put your BTC seed or private key(s) into a BCH client at some point... Personally, I think I'd rather download the ElectronCash source and either compile it myself or run from sources than use a binary from any of the BCH clients. At least that way you can be 100% sure that the code you are running, is the code you can see... And it's relatively simple to do (note: much easier on Linux than Windows)
Alternatively, you could create an offline, sandboxed (airgapped or non network VM or non network Live distro etc) version of the BCH client with your seed/private keys... and then use an Online version of BCH client with xpub/public keys to create watching wallet and create unsigned transaction... transfer unsigned transaction to offline version of BCH client... sign transaction... transfer signed transaction back to Online client and broadcast it.
Then destroy the offline client (a live distro with no persistence would be the ideal scenario, as you'd just need to power the machine down to wipe the RAM, others would require special care to ensure you had thoroughly wiped the data from storage media)...
I believe that should mean that your key exposure is minimised... and there is no chance for a rouge client to transfer your keys elsewhere.