Is it possible that malicious bitcoin wallet providers provide pre-generated private-keys for users?
You can verify the legitimacy of Coinkite's Coldcard key generation, assuming that you've used Coldcard's feature of generating the entropy for the seed words by throwing dice (the key generated will be based on your dice throws and so wasn't surreptitiously built into the card).
The web page https://coldcardwallet.com/docs/verifying-dice-roll-math gives details on how you can verify that the Coldcard honestly generated your seed words and key from your dice throws.
I should mention that I haven't actually carried out the verification, but it looks doable.  (Just be sure that you never enter the dice throws, seed words, private keys, etc., on any Internet-connected device, and never attach the Coldcard itself to the Internet or to any Internet-connected device.)