One step further, every software you didn't compile yourself and checked the source could have a secret trigger to do harm.
And you need to trust the compiler.
And you need to trust the compiler.
Unless you build from the transistors up you have incoherent security theater.
https://news.ycombinator.com/item?id=33899478
If you want to be 'really' secure, you can trust noone. No silicon, no software, no compilers, no certificates, no power grids, no networks, no friends, no coworkers, no nothing.
But that is no life I'd want to live. So I pick my battles and make sure my SecOps is better than 99.9% of the people out there. For me that suffices. YMMV.