Or is known to have weaknesses that might permit such actions. Microsoft permitting Chinese workers to maintain DOD systems presented a supply chain risk, even though MS themselves were not the ones likely to behave maliciously. Instead their policies were so stupid that they invited potential malicious actors into the facilities.