Your last point is why I don't really see the hype over RISC-V from an end-user perspective. Companies manufacturing RISC-V processors are free to add whatever private extensions (or backdoors) they want. And unlike software, you can't easily reverse engineer it to discover them.