Should events logged by smart contracts be trusted as a source of truth? Or are there any known ways to exploit them?
The logs are stored in the transaction receipt (Yellow Paper section 4.3.1 Transaction Receipt) and the root of the trie of transactions receipts is stored in the block header as receiptsRoot (YP section 4.3 The Block).
So they are protected by the proof of work of the block. You should be able to generate a cryptographic proof that a log was generated in a block.
When you request logs using web3 it doesn't provide a proof that you can verify and you have to trust the node being honest.
If you make your queries over the internet you have to ensure the communication with the node was note tampered with.