The basic problem?
When one is a customer, from private individual to Government, and in the market for the very latest high tech product (F135 in this thread but the arguement applies in many circumstances) then I don’t see how the customer can know as much about the product as those developing and building it. So how can the customer tell if the supplier is telling the whole truth or even make a valid risk assessment themselves?
If the customer must have the product, then in my simplistic and perhaps naive view, the only real protection a customer can have is two suppliers in competition.