(there is no panacea, cf. the XZ backdoor attempt, but serious investment in FOSS is a potential answer)

https://www.zdnet.com/article/what-is-immutable-linux-heres-why-youd-run-an-immutable-linux-distro/