The cap at 35% ensures the UK will not become nationally dependent on a high risk vendor while retaining competition in the market and allowing operators to continue to use two Radio Access Network (RAN) vendors.
In other words, the limit isn’t there to mitigate the risk of Huawei being malign (there are other mitigations in place for that risk, such as keeping them away from sensitive network functions). The limit is there to prevent the operator from becoming entirely beholden to Huawei.
Problems of course come when suppliers merge. I have contracts with 8 different supplier for my business, one goes bust, or jacks up prices, and I simply increase supplies of the other 7.
Then those 8 companies start merging, and before long you're left with a single supplier, or at best a cartel.
As for being able to mitigate a “man in the vendor”, whether the “man” is acting according to the vendor or whether the vendor themselves have been coercively controlled or infiltrated matters very little. Mobile operators generally don't even run their own networks today, they outsource the management of the critical platforms to the vendors themselves who often finance the deal too.
UK dropped the ball on this, but it dropped it 10-20 years ago, and now this kind of problem is going to keep coming up again and again.
Some of you might enjoy this examination I made of the topic and the context for all this. https://blog.eutopian.io/huawei-5g/