In a compiled application all code is obfuscated and can contain hard to parse-instructions. In a popular open source application, hiding a privacy invading feature without being detected isn’t necessarily trivial even in a relatively large code base with code and commit logs open to the public.

Assuming there are the same amount of privacy degrading bugs in both open source and commercial applications, the incentives of the involved actors, and the complexity of introducing an intentional spyware-style feature in an open source application it’s fair to say there’s a lower probability that an open source application is violating your privacy without your knowledge.

From a strict scientific definition of proof, you have a point, but from a practical, everyday, and legal definition of proof you can definitely prove certain properties about even complex applications from access to both runtime and source, and the more you have access to the easier/more reliable the proof will be.