How unlikely is it that some major iot device manufacturers outsource the firmware to someone who puts botnets in to start with? Who writes fridge firmware? D

How unlikely is it that some major iot device manufacturers outsource the firmware to someone who puts botnets in to start with? Who writes fridge firmware? Does ge or Samsung do that in house? Ovens? Definitely some liability there, but I'm not sure which way that drives it, out or in.