More likely the pathology of closed-source software and hardware screwing up because few people will see inside the code or RTL, and the limited/no penalties for delivering an insecure HSM/TPM, processor, baseband or almost anything else.