I'm in the market for a new phone. The cheapest ones with decent specs are from China. Unfortunately I've read articles of phones sending data back to China for spying purposes.
The phone I am looking to buy is the Xiaomi Poco X3 NFC which has had their code open sourced https://github.com/MiCode/Xiaomi_Kernel_OpenSource/tree/surya-q-oss.
I will be flashing it to one of the most trusted sources either Pixel Experience or Lineage OS. Let's assume that neither of these are malicious.
Then my question is, is it possible, that despite me flashing the software to something safe, that it still is malicious? The reason I ask is because I'm wondering what happens if there is a malicious bootloader and a protected part of the memory or storage that isn't removed. Then the malicious bootloader could initially load this part of memory / storage and initiate something malicious (ie a program that sends data to china) and then proceed to load the custom image that I've flashed. Im trying to understand whether this is even technically possible. If it is, how would I know if this was happening? Since the code is open source, can I check what is on the phone matches the open source code? Does the open source code even matter if there is some hardware that acts maliciously before loading the rest of the software? What would be some clues this was the case (either that something malicious happens initially or that a part of memory / storage is reserved for something malicious)?