Build artifacts are part of the update trust chain. Dropped regions or unchecked record boundaries can yield an invalid flash image even when the build stage finishes.
Use known input fixtures and image comparisons before deployment. The PR is about packaging integrity; it does not by itself prove malicious firmware tampering.