A backdoor found in any CPU would likely mean the death of the company, so your metric of the size of the company makes sense. Bigger companies have more to lose.
I don't have any metrics on how many chips ST Microelectronics sells, but they're pulling in $16 billion/year in revenue. Anicdotally, I can say the STM32 series are very widely used. So they have a lot of incentive to make sure their hardware is legit.
ST microelectronics also has their own fabs, which is better than them sending their designs to another company and having someone else make the hardware.
Counterfit CPUs would be more of a concern, but usually visual inspection will sort that out. The ICs often have different markings, dimples in the wrong places, poor quality screen proving, and so forth. The other tell is... they don't work. Like, at all.
Hackaday wrote a good piece on the topic a few years ago: https://hackaday.com/2020/10/22/stm32-clones-the-good-the-bad-and-the-ugly/
From that article: "If one orders MCUs and development boards from reputable sellers such as Digikey and Mouser, it’s also unlikely to be much of a concern."
I order mine from Mouser. I suppose ordering the parts yourself could be seen as slightly lower risk because you have no way to know I'm not lying and getting the chips from some sketchy source to try to save a few cents.
I think that speaks to all the hardware concerns you mentioned.