I guess you can still tick all the compliance checkboxes if you install the contractually obligated Fortinet device outside your DMZ and internally treat it as no more trusted that the rest of the internet...

Exactly. My first thought was: did they install Solarwinds as well?

Which is exactly what Kozubik was talking about!

lol. anti-viruses are the virus. the ultimate virus. don't execute any binary and you'll be fine.