This is something that has us worried too. The FCC took some action on this issue last year by outright banning equipment from certain companies (e.g. Huawei), but we haven't even scratched the surface of this pervasive problem. I really encourage you to share your concerns through an official comment. Maybe we the label can include commitments about the provenance (and, e.g., control of signing keys) of the on-device software and associated cloud services?