OP may also care about privacy.

Do you have the homepod code or are you just going by what a trillion dollar company that does plenty of shady things advertises to you?

Do you the source code for the microcode running on your CPU or are you just going by the corporate advertising? :)

Obviously we have to put some trust in corporations if we're not to live a purely analog existence, and so it stands to reason that we can put a little more trust in a company whose business model is selling premium hardware (and which increasingly sees privacy as a competitive advantage) than a company whose business model is selling your personal data to advertisers.

I agree with your sentiment that there is no absolute here; however there is a difference if the whole machine is a blackbox or just the CPU and is sold by a listed corporation that is only accountable to their shareholders.

They see privacy as a marketing advantage, however they collect data as they see fit. It is also important to note, that they are indeed in the ad business and even if it is no match to their hardware business they are profit maximizing. So even if they don't sell your data now this can change and your record on that big corp will become known to whoever pays enough.

Side question: Does Google directly sell personal data to advertisers? (For Google applies what I said above anyway)

apple makes 1/100th the revenue from ads that google does, so it's very clear which is abusing user data to do so

That’s a non sequitur.

You don't need the code. Just hook it up to your network and use Wireshark or something similar to see when it phones home.

Does it work without network connection? (just curious)

Yup! Not 100% Bluetooth works but I can confirm AUX working without a network.