It doesn't demonstrate the security of cryptography, just that entities exist with sufficient skill and knowledge for supply chain attacks but lacking cryptographically relevant mathematics.

It doesn't prove the hardness assumption, if it did we could trot forward any toddler and ask if it knows the factors to some RSA product, and "prove" hardness assumption for factoring integers...