"I can't be bothered to verify Pop_OS so I'll trust macOS, which is IMPOSSIBLE for me to verify."
How is code written behind closed doors by a closed, for-profit company more trustworthy than open source code?
There is always the reasonable doubt, whether it's closed or open, but it's much easier to do nefarious or just _unspoken_ things when nobody except employees under NDAs have access to the source code.
The reason you trust Apple more than Pop_OS is simply because you've decided to have pretty much blind faith in their marketing content and PR speak. That's not to say Apple acts in bad faith necessarily, but blind trust in a blackbox doesn't make for great opsec.