[Rjevski]

No enterprise would use the factory image, but a lot of small businesses would and they were put at risk as a result.

We can of course say they shouldn't have trusted it, but honestly, should it be normal to expect the manufacturer of the machine to be malicious?

Not to mention the other commenters pointed out that they used the firmware to reinstall the malware even on otherwise clean images, so even enterprises could've been at risk.

[cbzoiav]

If you don't trust the manufacturer then the OS is the least of your worries.

You can't trust the hardware, microcode or firmware either.