Open is nice, but the Cyanogen people need to pay the bills.
There's no point to CM if it's not secure. If they're installing Microsoft blobs by default, it's not secure. We know Microsoft openly cooperates with the NSA on eavesdropping technology - I even wonder if this is a subtle warrant canary.
Assuming the least-bad possbility, then if they want to offer an easy-to-use tool to install a tested Microsoft bundle from the CM servers, then fantastic - for people who want to make that trade-off.