"Since there is no way to prove the absence of malicious code or vulnerabilities in any piece of hardware or software, ultimately one has to trust the manufacturer to keep devices secure and not exploit vulnerabilities. This trust heavily depends on the legal and regulatory system in which the manufacturer operates. So it is not just about trusting Huawei or ZTE but trusting China. There are many good reasons to distrust China. Yet, governments should be cautious not to conflate issues with China's geopolitical strategy, industrial policies or espionage with the trustworthiness and resilience of our future mobile networks. The trustworthiness and resilience of mobile networks depend not just on the robustness of 5G standards but how those standards are implemented by the manufacturer and how securely these systems are configured and managed by the operator. On these four levels – standards, implementation, configuration and operation – proper threat modelling and risk minimization can go a long way toward addressing threats such as espionage or network disruption. Independent of the question whether to ban Chinese manufacturers, European member states should follow a risk minimization approach via regulation on all four levels."
The US manufacturers also have vulnerabilities in their systems but due to strong justice system in US, countries rely and still buy these.
This is a good paper by a German think tank on 5G from a national security perspective.
https://www.stiftung-nv.de/sites/default/files/5g_vs._national_security.pdf