To trust the code you need to understand it, or trust someone else that understand it. I would not claim I can do that without spending a lot of time since I'm unfamiliar with the coreboot code base in the first place. Saying "you can just recompile yourself" is as useful as "you can cook deadly mushrooms yourself" instead of getting food poisoning from a 3rd party.