And yes, that's a security liability

Hardly. If anything it's a benefit to security. You don't have to run all the secret stuff using FOSS stuff. Just anything that runs the hardware (like the OS itself).