the indignation was not that. you are still missing the point.
after the 1st device found, you should have contacted the manufacturer and said that you will start a department that has the capability of opening the device, inspecting and re-sealing in a way that it won't impact any guarantee the factory provides. If they denied this very sensible request, you had proof that it wasn't a isolated employee doing the hack.
because asking everyone how much they have in offshore tax havens is working so well.
heck, not even when the information is given to the IRS anything happens: https://en.wikipedia.org/wiki/Panama_Papers#United_States