Or for a less out-there example, Ken Thompson's classic "Reflections on Trusting Trust". At some point unless you are literally producing all of the hardware and software yourself you have to trust someone. The challenge is figuring out where that line of acceptable risk lies for you. It's going to be very different for an indie game dev vs a FinTech company vs the US DoD.

I imagine anyone with a BA in CS has wrote a OS from scratch.

How many systems on chips are in a moderen computer, not the main system and cpu, but every little chip and controller, the boot system, every board seems to have a little OS.

In regards to security, its all about analysing risk and trade-offs.

For me using containers from known vendors is a risk im willing to take.