Vendor-supplied malware is a threat that has been largely overlooked. That has to change.