> as the network grows, syncing from all relays becomes more and more prohibitively and databases grow to the infinite.

I think the main flaw in the reasoning here is that caching services don't have to cover the entire network. A caching service that only serves a few users can stay very small. The caching service selection might be buried in settings as you say, or it might run within the client (which is compatible with outbox model purism — what is a client but a local cache?)

In any case you have to trust your service provider, whether they're a FOSS client you run on your device, or an opaque web service sitting out in the ether. The key is redundancy. We have this on the relay level, but we would need it on the indexer level, the caching level, and the client level. This can be done to some extent by asking users to use multiple services, but that's pretty unrealistic from a UX perspective. Other mechanisms could exist for reporting on clients/services, like lightning watch towers, Wallet Scrutiny, or client-side stats which can infer censorship scores for different external services.