Say a random node accidentally connects to a bootnote which only lists malicious parties. How is this scenario prevented?
Generally speaking, the answer is yes, there needs to be some sort of trust in the Ethereum network as a whole, i.e. there are more good people than bad.
Yuval Marcus, Ethan Heilman and Sharon Goldberg co-authored a paper on "eclipse attacks": a scenario whereby a set of nefarious nodes corner a well-intended node, giving them the impression that they are in sync with the main Ethereum network when, in fact, they are not.
Some countermeasures to eclipse attacks were implemented in geth 1.8 in February 2018.