Some on HN defend everything GOS does (maybe not you, but there are some). Those people are hurting GOS.

Good security engineering isn't sufficient: GOS could accomplish the security engineering by making an OS for themselves on a private git server and never distributing it.

But if we want to help the public with security and privacy, then the outcome depends on GOS's brand image - perception drives public adoption, who will never read long posts on arcane engineering matters. It depends on GOS's relationship with Google and its individual engineers, a relationship in which Google and the engineers hold all the cards - they could choose to cut off GOS completely tomorrow at no cost to themselves.

It's an engineer's fantasy that you can ignore those things and just do engineering; life just isn't like that. Doing that would imperil or greatly limit GOS, which hurts everyone.