Even with trusted brands, a malicious actor can attack the vendor. For example, one could order devices, tamper with them, and then send them back via returns. The vendor likely tests it a bit, and then repackages it and sells it as refurbished, or maybe even as a new one.

The fun thing is that the same is true with software. Looking at a source code is hard enough, even for experienced programmers, and then how do you verify a piece of software that you don't even have the source code to? And if you have the code, how do you verify that the software is made out of that code?

People basically just operate on trust, you can't verify much of the stuff. Just try to stick to entities with reputation, and hope for the best.