Bureaucracy or Incompetence?

Quoting HDM:
"Look at how a hacker gets access to the driver: Right now I'm working on Microsoft's automated process to get Metasploit-certified. It [only] costs $500."

Quoting ISN:
"The irony of his statement lies in the idea that Vista trusts Microsoft-certified programsprograms that can include a hacker exploit platform that walks through the front door for a mere $500 and a conveyor-belt approval process."

Imagine the possibilities. I wonder, is this due to bureaucracy or just plain incompetence.