The code is good, but I have the same finding that it seems that users don't have to trust Muun, but Muun is trusting the users and goes in some debt to make it work :) 

Meaning the code is messy? 

Reading some of the back and forth's with @fiatjaf on twitter, it sounds like they trust the user a lot more than you'd expect.

k00b

247bf84fda

bitcoin

A Closer Look at Submarine Swaps in the Lightning Network

It's still really unclear how does Muun actually work. 
From reading their code I think I actually understand why would they try not really sharing it that much :) 
(I'm still recommending Muun FWIW)