This question is unironically very deep. As it’s privacy we’re talking, you decide what to trust on your own.

My understanding is that Tor provides anonymity for my threat model (ad-tech corporations).

But trust need to be placed somewhere. Do we trust Mozilla? All their emploees? Do we trust OSS? Does anybody actually review open-source code? What about supply chain attacks?

I am, a nobody, was personally invited to a Contagious Interview (a person, pretending to be a client for consulting was trying to place a rootkit on my machine via GitHub repo).

What about AI-assistet coding that actively tries to eliminate security gates?