FCC doesn't necessarily concern itself primarily with device functionality and security, but rather enforcing the rules of the road, so to speak, for the electromagnetic spectrum.
For example, if you sell a microwave oven, you need to use the ISM band or whatever they deem appropriate, and they won't mind whatever EMF goo it puts out. If your microwave oven deviates from allowed parameters, it will fail cert. If it interferes with telecommunications or other equipment and you sell it anyway, you can get in big trouble with Uncle Sam.
If you sell a widget that is functionally insecure but you don't lie about it in a negligent or fraudulent way, that isn't necessarily a problem. If you have a backdoor for some nefarious purpose, that could run afoul of numerous criminal or civil statutes. Some of these statutes vary by state, too, so best practice is full disclosure, of course.
For example, if you sell a microwave oven, you need to use the ISM band or whatever they deem appropriate, and they won't mind whatever EMF goo it puts out. If your microwave oven deviates from allowed parameters, it will fail cert. If it interferes with telecommunications or other equipment and you sell it anyway, you can get in big trouble with Uncle Sam.
If you sell a widget that is functionally insecure but you don't lie about it in a negligent or fraudulent way, that isn't necessarily a problem. If you have a backdoor for some nefarious purpose, that could run afoul of numerous criminal or civil statutes. Some of these statutes vary by state, too, so best practice is full disclosure, of course.