How do I know my "open-source" cold wallet is safe?

I've been curious ever since this thought came to mind.

​

Even though a wallet is open-source, how do I know the actual physical wallet that was sent to me by the original manufacturer is safe? How do we know the wallets that they send us have the same open source code that is published/verifiable online? Are we simply trusting their good reputation? If so, who's to say they can't rug pull us years from now?

​

I'm assuming it's possible to somehow verify the legitimacy of the code that's on the physical device, but how does the common folk with not a whole lot of technical knowledge do that? I hope I'm just overthinking this and it's not a "they wouldn't rug pull, bro" situation.