My understanding is they draw the line at updatability: if someone else is able to change the code, then they can exercise unjust power over you (i.e. there's a

My understanding is they draw the line at updatability: if someone else is able to change the code, then they can exercise unjust power over you (i.e. there's a power asymmetry between you and the vendor over who controls the device), whereas if it is just a fact of life that you cannot update a mask ROM, it is possible that there is no malicious intent from the vendor. It makes sense from the historical perspective, when it was cheaper to use a mask ROM than to incorporate flash memory, and you had to think hard about whether you have an incentive to push updates to the device. The economic incentive to the vendor consequently acted as a proxy metric to distinguish hardware from software. Admittedly, the line is more blurry now: you can do unethical things in mask ROMs (via crypto) to exert power over the user, a la trusted boot and DRM, and you can make things updatable by accident despite having no intentions to do so simply because flash is cheaper and more straightforward to install than mask ROMs.