Embodied AI systems are cyber-physical systems with hardware, firmware and supply-chain risks that go beyond software evaluations — security teams must clarify provenance, access paths, integrity, transparency and accountability before purchase.