Works at a very low level of course, pre-OS, filled with binary blobs, perfect for an xz-style or supply chain attack. I’ve not seen any confirmation, so just speculation.
Has not been famous enough so far to have someone invest in an audit, so this would probably be cheaper.
