In fact there's no suspicion or allegation of malicious activity. This all started as a "hey it's not oss and i can't stand things that aren't oss." With all the security scare theater being used to justify the "it needs to be oss" demands.