its not about supply chain compromise. its about device compromise.