They're also a category where security is inherently a user-visible feature of their products (and as such, it _should_ be easier to justify security engineers)