Do we have to trust at least one DNS seed? If I understand correctly, when new bitcoin node wants to join the network, it must be introduced by guiding nodes -- DNS seeds. DNS seeds can thereafter help new node discover more existing nodes.

So during the bootstrap phase, DNS seeds are the entry points for the new nodes. By looking at the source code of BitcoinJ:

   dnsSeeds = new String[] {
            "seed.bitcoin.sipa.be",         // Pieter Wuille
            "dnsseed.bluematt.me",          // Matt Corallo
            "dnsseed.bitcoin.dashjr.org",   // Luke Dashjr
            "seed.bitcoinstats.com",        // Chris Decker
            "seed.bitnodes.io",             // Addy Yeow
            "bitseed.xf2.org",              // Jeff Garzik
            "seed.bitcoin.jonasschnelli.ch" // Jonas Schnelli
    };


They are pretty much hard coded in the software. What if all of those DNS seeds are dishonest nodes? In this case, new nodes would be surrounded by dishonest nodes and it doesn't have chances to connect even one honest node and retrieve the genuine blockchain. Therefore, new nodes would be fooled in this case.

Does that mean bitcoin network still needs some extent of trust? And would it be a concern in reality?
What you are saying is correct.

I'll quickly elaborate on why these hardcoded dns seeds are required. The attack you mention is called "peer list poisoning", a strategy that can be used to segregate someone from the network. There are two main types of peer list poisoning:


Dishonest nodes: the attacker poisons your peer list with real nodes, but malicious ones. All of your transactions would always be forced through these nodes.
Void nodes: the attacker poisons your peer list with non-working nodes, a strategy often used to dismantle malicous P2P botnets.


You may think the DNS seed require an element of trust but it doesn't. There are ways to verify that a DNS seed is honest: if you run your own 24/7 Bitcoin Node with the right setup then your address should be available in a list returned by a DNS seed. They crawl the whole network and regularly revisits known nodes to check their availability. DNS seeds do not return a full list, so it's not very practical.

There are alternatives to using DNS seeds, such as crawling the network yourself, or even bruteforcing IP addresses and attempting a connection.