Nobody assessing a phone-system vendor thinks to ask about its staff’s trading software.
Code signing answers "did this come from the vendor". Here the answer was yes, and it was the wrong question.