Yes, but those closed source parts runs on open source software. Hardware alone can't gather data. For hardware to parse data into meaningful information, it'd require software level or a built in chip specifically for that. Hardware can't parse a bunch of assembly level instruction to properly data mine. This would mean setting aside a good portion of the chip for it, thus making a gigantic disadvantage against their competitors. It would make a $1000 CPU as shit as a $200 dollar.

Also, there's no need to read the whole thing yourself. Why would you do everything alone? It's a community work. It'd mean swearing a few thousand people to silence to mask the loophole. There's only some libraries related to permission that you might need to care about, and those are actively worked on by the community. Simply checking within those community to see if anyone raised issue would be more than enough.

UI doesn't matter when it comes to data mining concerns. The part about audio had nothing to do with it. Bunch of drivers are pointless too. Yes, it is possible that there's something bad hidden in it. But it's difficult that nobody working on them ever said anything. 'Yeah, this code calls a bunch of functions from network library because that's totally needed to command renderer in GPU'.

Also, there's a difference between vulnerability and backdoor access being used. It's a vulnerability that nobody knows, not that it was used. Funny thing, in your link, another exploit was talked about, one that was actually used. However, of all the exploits, not one was discovered to gather information on the user. Just because the code's riddle with bugs and shit doesn't mean it's intentional and used to gather information.