That's probably true, but some of the mistakes FP has made in the past could probably be widely exploited, so it doesn't instill a lot of confidence IMO. E.g., they were signing their OS images with the AOSP test keys.

It's not a particularly old company (a little over ten years I think?), so presumably they've had to learn a lot of those kinds of lessons at the start of their lifetime. But at this stage, I'd assume they've learned the lowest-hanging lessons, at least.