A lot of open source applications can’t be used by government agencies because the pedigree of the software can’t be verified, so you can’t be sure foreign entities didn’t add any code.

But really there’s a million ways to do this - even whatever application they used would have been fine if they simply printed out the redacted files and rescanned them.