I think we may have different definitions of ‘verify’ here. What I meant was I make sure to carefully check the shasums, while you probably mean going through the source code of the update.
AFAIK most vendors provide the former, while very few provide the latter.
(This ends the short digression, but I think both vendor trust and BIOS or boot security are interesting topics for the new place)