The EU Cyber Resilience Act (CRA) is a good example of why this distinction can be less clear in practice than it appears on ...