It's ok to buy their cheap hardware, but I strongly recommend replacing the software right away with e.g. https://download.lineageos.org/
But what about baseband firmware? It's quite a bit scarier. It can usually freely read and write into application processor memory and it controls all radios.
Baseband is where you'd hide your spying software. It does not change when you install a different Android version.
BTW: my phone was super cheap, like less than USD300, no strings attached. It is great for most of what I use: mail, hn, local news, signal, slack, telegram.
It's also part of the android one program so I expect it to receive updates faster than my old phones.
The camera (or the camera software) has some real problems though: it's not as good as my older samsung S7 and it sometimes freezes.
Maybe the slightly more expensive models have better cameras, mine was about the cheapest reasonable phone I could get.
If the bootloader is locked or there aren't any good open source builds, just don't buy it.
HMD is a Finnish company with headquarters at the Nokia Campus in Karaportti, Espoo, Finland, opposite Nokia Corporation's headquarters.