Nice explanation. So here's a glimpse into my paranoia world.. I know that nothing is safe and all I can do is minimize the risk as much as possible. I usually tend to do this, by trying to stick with a supply or company that would be risking their business if a serious vulnerability was found in their supply chain or hardware. Eg. Lenovo. Yubikey. Bitwarden. Anything further, regarding IoT like components, usually gets a pass because it's not going to be able to pierce into anything sensitive just by doing what it's doing (like being a temperature sensor, or etc.).
Where my paranoia ratchets up in this case is when I think about using it for passwords and that it has USB access... Things that are core to my security posture. Could be a knee jerk reaction, as security becomes sometimes (ie.unknown USB passwords bad). Lol. Your explanation makes sense though..
Whether ST can be trusted and how to determine if it is a genuine ST or something that just looks the same. Or if China realizes the chip is being used for passwords and gives it a higher probability of a backdoor. Would ST have an economic reason not to have backdoors? Would purchasing from you vs. purchasing via other channels lessen the risk? How many people and companies use this particular chip and what do they tend to use it for? That's the kind of thinking that goes through my mind assessing this stuff..