There haven't been any significant incidents on FOSS software developers turning evil and pumping their software with malicious code. But each person is different, with different intentions. While I can't imagine myself doing anything horrible, some people build up reputation, only to crush it by committing a self-beneficial act and dive into the ocean depths, leaving others with sad reality and frustration. I'm convinced that FOSS software published by anonymous developers is trusted, only because it's FOSS and all this culture surrounding it.
Generally speaking, both intentional and unintentional damage is just damage. Now what GPL states, is that the copyright holder is in no way responsible for any damages. Does that literally mean, that if I stored my credentials on a GPL-licensed password manager, Bitwarden and they happened to anyhow intentionally compromise me, I wouldn't be able to sue them and win the court case as I wasn't given any warranties, that it will work as intended? Same thing, if some guy added a zero-day malicious code into his software, that antivirus isn't able to detect yet?
Proprietary software vendors take responsibility for what they made and will be fined for anything malicious.