They're basically the only company allowing you to root a phone without loosing warranty. And it's not like other manufacturers come without FB installed as system app - yes, they're a bit worse on privacy by default, but it's not like they're the black sheep within a pile of innocents.
They respect their customer by selling hardware 50% off compared to Samsung and 80% off compared to apple. Having this with custom rom is a bargain imho.
How do you trust the hardware? Granted, how do you trust the hardware in any phone. But the risk may be higher if the entire production chain is in the one country with privacy/surveillance abuses.
Well you don't, but 1) no one can be trusted anyway. 2) one can analyze traffic after flashing to see if it is still phoning home. I won't expect it to, it's just too much hassle compared to doing it with software, just for sake of someone who flashed custom ROM. If you have real reasons to be worried about Chinese spying (like business/government work) then obviously you wouldn't buy any hardware like that anyway.
Like which other manufacturer of the size and scale of Xiaomi? Every single one of them has locked bootloaders, Samsung even bundles ads, and all of them without fail use Google Play Services and all kinds of other proprietary nonsense that can and maybe should be categorized as spyware.
I don't know. I agree that it's not a customer friendly policy. But if your already stuck with a Xiaomi phone you have to either return it or bite the bullet, not much else you can do.