Operating systems are the systemic risk to crypto.

If compelled by the state…Apple, Google, and Microsoft can backdoor billions of devices through software updates to scan for private keys.

The capability exists.
https://www.theverge.com/2022/12/9/23500838/apple-csam-plans-dropped-eff-ncmec-cdt-reactions

That's why my private keys are written on a piece of paper.

Building poolfish.xyz (/poolfish). A calculator for LP providers. Cooking /hotpotato. Built Potion solo to $6k+ MRR and sold for $300k.

Does a hardware wallet help in this case? Then trusting them of course.

That doesn’t actually help that much, because if the private key is ever present on the device (such as when sending a transaction), it can be scraped by a malicious OS and your wallet drained.

(There are workarounds like never fully putting the key together and only broadcasting signed transactions. Not that easy.)