That's an old principle, and it is, unfortunately, still true. It all depends on where you want to put the trust slider, but push it far enough in the conservative direction and, yes, you enter "build your own machine from scratch" territory.
How do you know the hardware you use doesn't have a microdot that can bypass the monitoring logic and physically manipulate the radio without the OS's consent?
How do you know the software you're running doesn't embed its own bluetooth stack and use a 0-day exploit to gain physical control over the radio?
Oh, you compiled it yourself? With whose compiler? Are you sure that compiler faithfully adheres to the spec of the language and doesn't know how to embed a bluetooth stack that, etc.
Push the paranoia slider far enough, and you end up having to care about all this stuff.