They could have chosen another manufacturer (though I doubt there are any with the same price/performance/power consumption level and fully documented).
Also, I think that nokia could have put more pressure on its suppliers than some lone hackers in their basement, but they didn't, so while they're not 100% guilty, they're at least 50% guilty