But also if a modification of the SPI bus can result in exploitation then the manufacturer will just patch the memory in place. Cheaper, easier, less detectable. So... the manufacturer is not the source of attack.