the concern is not so much where code was written but how easily...

the concern is not so much where code was written but how easily an independent party such as a customer or their auditor can audit the code to verify it is fit for purpose. I recall that NET hold the code separately in each region which I assume is to build this local trust and to allow the code to evolve with region specific extensions. In other words if the Japanese IoT lab doesn't trust the software build coming out of China they can audit and build locally... assuming NET lifts the Kimono