Even if the hardware is only what is spec'd in the Open Source model, the model itself has a lot of complexity for bugs to hide in. Those bugs might be intentio

Even if the hardware is only what is spec'd in the Open Source model, the model itself has a lot of complexity for bugs to hide in. Those bugs might be intentional, they might not be. The same obviously goes for software. Even really-high-profile open-source security suites have seen critical bugs that have been around for many years. Being open source is a good start but it's hardly sufficient to guarantee anything about the supply chain. The opposite may actually be true in some cases.