I bought an el cheapo 3.5" LCD for my Raspberry Pi from Amazon. It turns out there are many people making copies of the design, to the effect that the first(?) manufacturer says that their LCD is being "pirated". Amazon reviews sent me to the Waveshare site to download the drivers, and there is an SD Card image available as well. Adafruit's 3.5" LCD gives you similar options to manually install the drivers/kernel, or use their prefab SD Card image.
I understand and appreciate the manufacturers making it easy for Linux n00bs to use their hardware. However, how do I know that there isn't malware, spyware, or other undesirable software bundled with their SD card image?
Hailing from Windows, as most people are (5:45), it doesn't make sense that I have to replace the kernel to add a driver to a Raspberry Pi, or that an LCD driver is hundreds of MB. But Linux is different, so OK.
Maybe not historically, and maybe not soon, but at some point, some kind of bad software will make it into these SD images. How can I vet such images? How can I scan them for malware or other unwanted software? It may not be a virus or a trojan that gets bundled, but some kind of cryptocurrency mining software, or some kind of data exfiltration software. Some kind of Internet Transmitted Disease (ITD).
I understand there is a whole industry devoted to Infosec, but what are the first things a hobbyist could do, learn, or have as "common sense" for this situation?