"Their MO seems to be to improve the overall IT security of the nation such that it's less vulnerable to less sophisticated actors but still vulnerable to them.

"Their MO seems to be to improve the overall IT security of the nation such that it's less vulnerable to less sophisticated actors but still vulnerable to them." That's exactly what they do. How they rate and evaluate their high-security products (Type 1 or EAL6+) vs majority of market (EAL4 or less) under Common Criteria corroborates your claim. EAL4, which Linux and others top out at, says it's only trusted to stop "casual or inadvertant attempts to breach security." Anything prolonged or well-funded will breach it.