This. Unless you flashed it yourself from code you compiled and analyzed yourself, or have a verified signature/hash, assume that it’s pre-compromised and the “agencies” have access to it. For 99.999% of us, this doesn’t matter outside of civil liberties or whatnot. For the 0.001%, you’re their target audience. Smile for your camera. Ask Kaspersky.