That might be true. Absolute safety is hard to guarantee. I would put it this way: it’s a question of business model.
The business model in the phone duopoly is surveillance capitalism, monetising the customer without the customer’s informed consent, collecting as much data as possible, and selling that data for as many dollars as possible, shipping your data to the buyer. That’s the business model so nobody (in this forum) is at all surprised that it happens.
The business model of Purism is the exact opposite, protecting you from surveillance capitalism. If it ever happened that Purism had intentionally gone against that, the business would be screwed. It makes no sense for Purism to consider doing that, not even for a nanosecond. Purism has every incentive to try their hardest to protect you from surveillance capitalism.