This is a key for company firmware, so the second point has nothing to do with it, except the easier it is for a user to write their own firmware, the easier it is for malicious actors to do the same.