Well, here’s a quote on a topic sharing similarities with yours :
In the case of hardware, as most of it is closed source, we don’t have to just “hope” it does exactly and only what it advertise and analyze it, and we actually do that for closed-source software as well, and that’s often how we discover something fishy. Granted it’s easier to analyze something when you know exactly how it should operate, but we can already do a lot even without knowing all of the inner working, and it’s enough for a lot(most) of people.
I don’t think we ever found any evidence of Intel ME or AMD PSP being exploited (don’t quote me on this EDIT : link that contradict this statement are just below in this topic, this make this argument no really valid, it’s still easier to exploit software bug/vulnerabilities, but it’s far from impossible to do the same with hardware!), but we do have lots of evidence of 0-day, hack, honeypot in closed-source software.
In this regard, QubesOS is “reasonably” secure by being open-source, and focused on security (Security by compartmentalization).
The benefits are huge in terms of security, because using will allow you to compartmentalize anything in term of level of trust, for software, but also devices as it is the case by default for your NIC and USB-ports.
Well, Xen’s hypervisor and dom0 running on my computer.
I trust the software because I think I reviewed it enough and I trust the people who wrote it because they avoid taking unnecessary risk and they don’t make statement that are refutable.
Did I provide answers for all of your questions ?