Unreliable suppliers can modify devices, yet companies devote few resources to verifying the origin of components