Even that process can be flawed, see: Crypto1 and all the shenanigans that followed.

Recent UL-C/AES disclosure too IIRC