Have you ever tried to read the source code of Linux? There is so much code that it is pretty impossible to go through that. I would not be surprised if there were some surprises hidden in there too. NSA could have some programmers "contributing" to developing Linux, who could know. A well designed "bug" could be all that they want.
But I too trust Linux much more than windows, which really is spying its users.
As for hardware wallets, I have to be honest that I have no idea how they work internally, but the fact that they have been completely safe thus far suggests that they're quite trustworthy. There are probably some out there that houses hundreds of thousands of coins. But then again, there are only no incidents until there has been an incident, so that could change in a hurry. I personally still trust them because it's not like they're running on some kind of freemium model, but that's just me.
I trust hw-wallets too, but there could always be a bug in them too. Paper wallets are safer, if the key has been made with a good RNG.