[bpp]

Your point about FDA's mission is paramount, but in this case it extends to HHS (its parent) as well. It'd be foolish to expect large (calcified) government agencies to, of their own accord, take on tasks so far outside of their core competency. The FDA primarily deals with substances that we put in our mouthes (although of course they do have responsibility for medical devices). Security engineering just isn't at the core of their mission; this is the kind of thing that ideally could be outsourced to a better-equipped agency.