The UK has found many, and documented outline details of them in annual public reports, like [1]

In outline:

- Version management issues, with different firmwares being used for each operator, with significant variations in each one [1].

- Failures to follow Huawei's own secure coding guidance, and sustained examples of poor coding (examples of which include tricks of the form of:

    #define SAFE_LIBRARY_memcpy(dest, destMax, src, count)memcpy(dest, src, count)

to make code appear to no longer use unsafe functions, and make auditing harder. [2]

- When critical vulnerabilities were found (arising from poor code quality in user-facing protocols, and an old operating system), they were fixed, but the fix introduced another major issue into the product in question. [1]

- Reliance on out-of-support RTOS in products, and no alignment of own product lifespans to external support lifespans, and no identification of this issue by themselves. [1]

- Previously, 70 full copies of 4 different OpenSSL versions were found in products (and 304 partial copies), some of which dated back to 2006 with multiple disclosed vulnerabilities in each, showing no dependency management at all, and no management of vulnerabilities in dependencies. [2]

[1] https://assets.publishing.service.gov.uk/government/uploads/...

[2] https://assets.publishing.service.gov.uk/government/uploads/...

Doesn’t matter. See Australia. The CCP would gladly withhold teleco infra gear or back door in an update to suit their needs.

Sure USA might do the same. But the USA is aligned closer culturally and values wise to the rest of the west

Does it matter if they did? At this point, everyone has to assume the CCP has the ability to take complete control of any Chinese company it wants to (see Ant Group). I’m not sure why they even bother with the “monopoly” or “corruption” pretenses at this point.