How do you know which code Wasabi is running on their servers, though?
You don't. You only know what code is running in your local copy of Wasabi wallet, which isn't the entity doing the spying and so is irrelevant to the discussion here. As soon as you attempt to join a coinjoin through Wasabi's coordinator, your inputs are sent away to a third party server with who knows what code running on it. From there, you have absolutely no control over what happens to your inputs, where they are stored, who gets to see them, or which third parties they are shared with.