Honest question - if it comes in binary form, how can you know it's the same core ZFS code BSD uses?

Same as anything else installed as a binary package - you trust the people packaging/providing the binary. If you don't, build it yourself. The source is publicly available.

Or you build it yourself and verify you got the same checksum.

https://reproducible-builds.org/

Debian only distributes it in DKMS form, not binary form.