My /bread/ is batch coded and traceable, but the software on your WiFi router probably isn't

Procedures like the Linux kernel's Developer Certificate of Origin and Signed-off-by/Reviewed-by system, and more recently the use of signed tags, go a long way towards the kind of auditability you suggest. More to the point, developers need to actually understand the licenses and conventions around the software they use.

Going with the lowest bidder and not reviewing their work will cost you dearly when you find out they've screwed up. That applies whether they introduced a bug that gets you bad PR, or a license violation that gets you sued.