If this is your threat model, you can sideload the app instead of installing from the app store. This way, you can verify that you have the same app as everyone else and have not fallen victim to a supply chain attack.

Ensuring you received an unmodified phone without a nefarious operating system or baseband is probably harder.