Vendors with nefarious intentions or operating on directives from a state agency are a real and valid concern, but the handset under consideration makes use of a Qualcomm baseband chipset, so the OS it runs on is supplied by Qualcomm, not the manufacturer.

If I understand it correctly (but please do correct me if I am wrong), Qualcomm supplies the baseband OS as a signed binary blob.