Understand your concern. You might be able to reach our to someone like James Pulver (jmp242) on the forum about getting a parser added to future release for 3com. Think they would want more samples than the one we were working on, but that is definately a possibility.
As for the transform question:
You want to be able to classify the events to an event class and hopefully just once - if you were to just forget about the parser we worked on, you would have to write a transform in the /unknown event class to look for one specific syslog event and then try to re-classify that event in the transform to move it into another event class not sure how that would work, but might.
By writing the parser, you are able to get an event and reclassify it (map it to it's final event class). This will/should help in the future if you have multiple 3com event types that you want mapped to different event classes. In a transform, this wouldn't be impossible, but would become more difficult depending on how many mappings you have.
Make sense?
--Rob