So you're saying at some point you will make the decision to trust them based on... what? Will you go to their premises and inspect everything they do? Will yo

So you're saying at some point you will make the decision to trust them based on... what? Will you go to their premises and inspect everything they do? Will you analyze all their processes? And for how long? At which point will you decide it's "satisfactory"? Will you account the cost of the analysis in your process? If the source code is in a language you don't understand, what will you do? If you go down the rabbit hole, it's endless.