You can inspect and trust anything and still be vulnerable to one source of a bug. In the Coldcard case it was the source of entropy for seed generation. Mitigated if you use dice rolls (or coin flips enough times ) as source of entropy. Specter DIY also has a similar capability. But it can have a different bug. Mitigated by use of a passphrase or multi-vendor multisig.