Thank you for your replies!
I guess my question comes down to:
How can we know which software/hardware is safe and keeps user information private?
Under what threat model? Without bounds this question is impossible to properly answer, but regardless will practically always have the answer "none". There is no lock ever invented by anyone ever, physically or digital, that cannot be broken. Even something like OTP that is theoretically perfect encryption will not keep your information safe if the key is lost.
All safety properties need to be defined under a threat model otherwise there's nothing more to it than "no. It's not safe".
Is it safe to take a walk? Under a regular threat model you'd probably say yes in most cases. But if you include in your threat model the eventuality of a meteor landing on you, no. It isn't. It's unlikely to happen, but you're not safe from it.
How can we know what software is considered safe under regularly considered threat models?
Read the source code if it is available, have security audits of it, monitor its network traffic, attack it and challenge other people to attack it and see if anyone succeeds.
From a consumer perspective; Keep an open eye on news within the field and just follow good computing habits. Trust software the same way you'd trust businesses or people - If it stands in front of a dark alley and begs you to follow it so it can give you a load of cash it's shady. If it's a business with a big green sign that says "FREE SERVICES", it may be a legit business but suspicious to warrant investigation. But you will trust Tesco not to sell you food that will poison you, because it's in their best interest not to do so. It might happen on rare occasions regardless, but they don't intend for it to happen.
As for hardware it's a very similar answer, really, but I'd argue that if you're worrying about the security of the hardware your threat model is beyond that of any consumer and you need to hire an IT Sec department on what Trusted Computing Baseboard Management Chips (TCB BMC) to have in your server infrastructure
The T2 found in a lot of Macs is such a chip but it has been exploited and has known vulnerabilities. None that are severe, none that can be remotely exploited, none that have ever been used maliciously in the wild, but known exploits.
That M1 and A14 are to my knowledge not known to be vulnerable to any hardware-based attacks at this moment.
Almost no Windows laptop or to my knowledge Android phone will have chips like this. I'm sure they exist but they are rare. Mostly this kind of thing is just for servers or at the least is implemented in a smaller scale.
But this does not mean these devices are less secure under pretty much any threat model any consumer or professional would have to consider.
Keep your software up to date (mostly), practice good online habits like using secure passwords, don't blindly click yes on every popup;
And if it really is about Life or Death and the launch of nuclear war - Don't use computers. Not offline either, you never know who'll break into your home and modify the boot loader.
The "best effort" approach though, is to live normally but be conscious. If a corporation's wealth comes from analytics, they don't have your privacy as an interest. Use macOS, OpenBSD, FreeBSD, Linux and keep your packages/OS updated, be aware of TLS/SSL connections and clear-text. i.e the padlock in your web browser here signifies and encrypted and authenticated channel of communication. You can be sure you're talking to MacRumors and you can be sure that nobody's reading the traffic that is sent back and forth. Your DNS request is most likely clear-text so it can be snooped which websites you're visiting if someone is snooping on your network, but not what data is sent between your client and the server. Email on the other hand; Unless you're using S/MIME, is fully clear-text and not encrypted at all.
There is no general formula, everything needs to be inspected independently
And with that, I should get back to preparing, because funnily enough my exam in security is tomorrow
