Given the many vulnerabilities across all vendors over the last years, secure development and operation practices are missing across the board. Cisco managed to fuck up their entire secure boot solution (https://thrangrycat.com/), Intel's ME can be taken out of service despite "firmware signing", and I presume that a proper audit by the government would have uncovered that.