How do you find products to trust?

You don't really need to trust. For significant amounts of value, a multi-sig setup using a number of different devices means that _all_ the devices could be compromised, but providing they are not compromised by the same attacker your bitcoin is still safe.

What if the multi sig software is compromised?

When I said "different devices" I meant different types of devices (i.e. all running different SW) - sorry for not being clearer.

For example you might create and sign the transaction with Sparrow on your PC and then pass it to/from BlueWallet on a mobile to co-sign it via QR code.