Fully open source hardware with an audited supply chain would be ideal, yes. We're not quite there yet, though some groups are working on it, and a device like

Fully open source hardware with an audited supply chain would be ideal, yes. We're not quite there yet, though some groups are working on it, and a device like the PinePhone is a big step in the right direction. There is still a risk that components may be unknowingly compromised but at least you're not stuck running software on "your" device which is publicly acknowledged to place the manufacturer's interests above your own. It's still a good ideal to enforce compartmentalization and privilege separation, of course. That last sentence was aimed at knowingly running untrusted proprietary software and relying on compartmentalization alone—I didn't mean to imply that one should forego proper security architecture just because the hardware and software are a bit more open.