[lederhosen]

But we do not know if it works, do we?

Previous implementations have been crippled in ways that suggests that it could have been done on purpose. Limit the password to few characters and permit unlimited tries on the "secure" hardware. Data recovered in subseconds.

I suggest it was either done on purpose or they are incredibly incompetent. Which alternative do you believe to be true? Either way, why trust them?