You can inspect and trust anything and still be vulnerable to one source of a bug. In the Coldcard case it was the source of entropy for seed generation. Mitigated if you use dice rolls (or coin flips enough times ) as source of entropy. Specter DIY also has a similar capability. But it can have a different bug. Mitigated by use of a passphrase or multi-vendor multisig.
Gotta try it and give kudos to my auntie who has been doing it since more than 20 years. Respect to all wise women doing it their way. Lots of inspiration.