> how can I trust that the OS images of this company don't contain any spyware?

Software from board manufacturers shouldn't be used anyway, if not because in a few years it is often discontinued and not updated anymore because they're pushing newer models. Thankfully we have Armbian and Dietpi which are the distros of choice for all boards that don't run major PC oriented distros (and a nice alternative for those that do). The number of boards supported by these two distros is astonishing:

https://www.armbian.com/download/

https://dietpi.com/#download

The NanoPC-T6 is already supported by Armbian build system:

https://github.com/armbian/build/tree/main/config/boards