It's also hard to distinguish between legitimate security threats and scare tactics designed to make us think we're in danger. Remember the Bloomberg Supermicro "bombshell"[0]? I still don't know if that was ever confirmed true or false, but to my knowledge Bloomberg never retracted it.

[0] https://www.theregister.com/2021/02/12/supermicro_bloomberg_...