How do we know any device is doing what it is supposed to do? For example, Android is an open-source OS (ignore google libraries for now) and they do claim that all passwords will only be stored on the device. But what if they are storing it on their servers and this piece of code is not in the open-source version but it is there only in pre-compiled libraries? How do we check that the same code is there in the actual phone and open source version? Same goes for other devices like iPhones, routers, desktops etc.
Also, most manufacturers nowadays have encryption enabled which makes it impossible to monitor the actual content on the TCP/IP packet.
We can always remove the existing OS and install the open-source version but that's not possible in all cases, as in some it might be really confusing and might even need a lot of extra stuff that people don't usually have.
So my general question is how do we verify if the same code is there in the open-source version and pre-compiled binaries? I can think of reverse engineering but that would require great knowledge and skills which most people don't have.