@2 1. Maybe they know of vulnerabilities that you don't. Remember the bug in Debian where cryptography was being seeded by the process id? 2. They might have

@2 1. Maybe they know of vulnerabilities that you don't. Remember the bug in Debian where cryptography was being seeded by the process id? 2. They might have put a lot of time into ensuring that one particular product was 100% secure and trust only that one. This is often the case for hardware, where vetting for security compliance can be difficult.