Examining CISA's urgent directive to fix a critical Cisco vulnerability raises questions about surveillance and governance in cybersecurity.