Purism can "look into" whatever - they're going to be playing catch up until they have serious security researchers.

I used to be enamored by Purism publications until I saw GrapheneOS.org.