Most of the time such reviews are not practical; they cost too much money and don't deliver results. Such review industries are almost always all about the rubber stamp and don't end up employing competent reviewers.
See e.g. the Infineon ROCA flaw that FIPS certification didn't catch (even though that code reeked of them being too clever, and should've gone through proper cryptanalysis).
See: flaws in the FIPS YubiKey (specific to that version! The certification requirements introduced vulns!)
E.g., they get to review all hw / sw / firmware, and if appropriate make a public affirmation that they could find no vulnerabilities for that stack?