The NSA being able to see what you can do, is not an acceptable trade off.
So to a certain degree we're always compromising. Cloudflare is compromising a lot.
But yes, if nation states are part of your threat model, the safest practical way to acquire hardware is probably brick-and-mortar retail, and only after installing a sophisticated home security system, also acquired at retail, and thoroughly sweeping your house for existing bugs once it's installed.