The point is that if someone really wants to get into your device, they will. It doesn't matter if youre using open source firmware, in a custom implementation of linux, on a MIPS CPU, and you personally build every package from source and complete a compliance code review before installing it, etc.etc.etc. If government agency x is targeting you specifically, your best line of security is to lock your device in a safe, take a boat into the middle of the ocean, and then dump it at an unrecorded location and never retrieve it.

A device is only secure as long as you are not using it, and it is not accessible physically, or by network.

You do you dude, I'm just saying your advice is awful for the average user.