Since we're speculating here, I hope whatever phone you have allows you to lock the bootloader (My oneplus doesn't after installing LineageOS). And certainly NSA has no way of infiltrating AOSP or less hardened chipsets.