Ken Thompson has something to say about trusting the compiler you use for that OS, or even the microcode the CPU running said compiler is using. It’s functionally impossible to not trust an outside vendor for something on a modern computer
https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...