Yeah, I think this is the only way to get something that actually has a chance of being a) secure out of the box and b) likely to get security updates over the lifetime of the hardware.