Those are both great examples. I think this doesn't obliterate my point, though it weakens it. The manufacturer in CVE-2026-11405 is already out of business, and the one in CVE-2026-66747 is unlikely to continue as a going concern.

Would Xiaomi or the CCP accept the reputational and legal risk of getting caught with a backdoor? Recall the CCP considered the arrest of the Huawei executive in Canada as an offense against itself.