At least half the point is checking whether the source code is total crap. Detecting intentional, malicious backdoors is a lot more difficult, but the threat of

At least half the point is checking whether the source code is total crap. Detecting intentional, malicious backdoors is a lot more difficult, but the threat of a static analysis tool finding something is probably enough to keep vendors in line.