Grapheme runs tests on googles firmware regularly.
If it was actively doing something it shouldnt, they'd notice.
You could argue there could be something hidden in the firmware for use by the state when they REALLY REALLY REALLY want to get into something, and are willing to blow a good backdoor on it. But that's also something you deal with on any modern PC, unless you wanna party like its 2011 and run an old FX-Series AMD chip, or a librebooted machine with ME Cleaner. (See Intel ME/AMD PSP)