Anything and anyone outside of a BIP-38 is a security hole.

There are degrees of trust in this racket

Not open source, yeah it's licensed 3rd party who yields the power of the state against collaborative Bitcoiners.