Why should I trust SuperSU / TWRP / Clockwork / ...?
The same reason that people trust already-compiled builds of Ubuntu, LibreOffice, Linux kernels and mainstream-compiled builds of thousands of other open-source efforts. 

Namely that they are being backed by large organisations of people, the code or patch file used to build it is required to be submitted (and is most likely diff'ed against the original build, making the insertion of malicious code extremely hard to hide), and the maintainer is usually a trusted member of the community around said program.