That’s true of everything you haven’t compiled yourself, using a compiler you wrote and bootstrapped yourself.
There is no technical proof that any of the software or hardware we use every day is trustworthy. There is, however, incentive alignment that makes it unlikely that companies do wild and crazy things.
Still not 100% secure. Someone can MITM your connection and forge the info used to verify builds.
It’s a silly example, but the point stands: there is no 100% security for anything that any other person or system has had any access to. It’s not a reasonable standard to demand.
