Is open source software synonymous with security and reliability?
No. It's synonymous with transparency and verifiability. Open-source software can still be malicious, badly written, and full of bugs. It just comes down to when those issues will be discovered, reported, and/or fixed. Why is there such 100% trust in the open source?
Only because you can check what you are running and what the software does. In reality, most people don't check the code, but they like that others can. Could it be that Trezor or other HW brand puts one piece of software on public display, but installs a completely different one on their devices? Is it possible to implement it in such a way that it cann't be verified?
You could have the users install one piece of software but make something else public. But if you compared those two codebases and tried to reproduce it, you wouldn't be able to do that. Therefore, it's not the same software. If you are really unlucky, you could install a malicious update and face the consequences before the issues are found and corrected. But the advantage of open-source over closed-source is that experts can find those problems by looking at the code. With closed-source, there is nothing to look for because it's not made public. 
