The silliest thing about it is probably this. Google seemed to have just kind of forgotten to add code that would verify the rootfs on shims, even though they had everything they needed to do it already set up.

https://chromium-review.googlesource.com/c/chromiumos/platfo...