'That's not a bug, it's a feature' takes on a darker tone when malware's involved

This opinion piece argues that in firmware and IoT infrastructure, 'malice can be indistinguishable from incompetence,' highlighting concerns over TP-Link routers’ vulnerability-prone firmware, potential covert state influence and supply-chain tampering (including references to Chinese legal pressures and Salt Typhoon), and a recently disclosed Iranian-linked IOCONTROL attack on energy/IoT devices. It contends that industry and regulators lack mechanisms to detect and correlate maliciously inserted flaws or insider exfiltration, creating an unchecked, industry-wide meta-vulnerability.