Why would NSA bother with OSs, if they could get direct access to firmware, theoretically?