Why would they do it this way? If they're going to add a custom controller on the outside, why not make it encrypt before writing to the SD card?