You do realize that this "third party" is how FOSS works, basically? Community = Bunch of people volunteering to develop and maintain things. N900 is old. Very old. Nokia has ended updating it a long time ago. CSSU is continuation of official updates, but made by community and open source. The original OS had quite some closed source parts too, which have been mostly replaced with open source, by the community during these ten years. Staying in the original also doesn't mean staying safe. It's quite opposite actually, and it's not upgradable without the cssu.