If NVK and friends were shipping products with firmware that doesn't correspond to the published source code, every single Coinkite product must be considered potentially compromised.