You can already see all the code on GitHub since, as you pointed out, it’s open source.
As for the community validating that it’s not malicious, that would require getting enough volunteers from the community with the required expertise and coordinating them to spend their time and effort on every update. That would be a significant social and logistical challenge. You can see a similar effort underway here: Qubes code audit - #11 by illuminati
No, updates are cryptographically signed. If Qubes OS can’t validate the signature on an update, it will reject the update, so that wouldn’t work.
The most important part (cryptographically-signed updates) is already implemented and has been since the beginning.
The developers review each other’s work, and since the code is open source, anyone else can review their work too.
We also have canaries: