Why would they do it this way? If they're going to add a custom controller on the outside, why not make it encrypt before writing to the SD card?
Because incompetence.
[flagged]
Because incompetence.