Yes you need to trust your operating system developer to some extent.
If your threat model includes not trusting the company that writes the source code to your OS…don’t use computers I guess?
For example in the case of email, you generaly dont worry about google reading your email but we should definitely be concerned if gmail allows send & recieve from only few domains or providers it chooses.
Does that service also have to trust the OS developers? Correct me if I'm wrong, but I'm under the impression that services can decide whose passkey implementations to trust.
Seems like that should be up to the user, not the service.