You can inspect and trust anything and still be vulnerable to one source of a bug. In the Coldcard case it was the source of entropy for seed generation. Mitigated if you use dice rolls (or coin flips...