Agreed, although the blame then still lies with the device the secure kernel is running on, or the company that produces it, or the client for choosing to buy it.

I guess you can say that proven software is power, and power can be misused.