This absolutely true and a good point. In fact you gave to audit the code you run too. You have to decide who to trust. So how fo we mitigate that?

Decentralization & Cryptograhpy

Cryptography allows that the person you are trusting is the only one who could have changed it. For this we can use code signatures. And of course you tun your local copy (distribution) which you can audit, and compile yourself. That makes it much harder.

You can analyze your hardware and once its left the factory it us harder for the maker to influence.

The point isn’t that you csn economically get rid of all trust, but that choosing to trust a third party is a security hole.