Your reasoning doesn't make much sense to me. Companies are temporary entities, even though they don't like to think of themselves as such. Companies get bough

Your reasoning doesn't make much sense to me. Companies are temporary entities, even though they don't like to think of themselves as such. Companies get bought or go bankrupt. So when I buy a device which only loads signed code, there is no way to know who is going to be able to sign code for my device in the future. I'm also out of luck if I ever want to run my own or someone else's code on my device. The attack surface is completely dependent on the actual code being signed, so the signature doesn't provide any security benefit to me. And in case there were 3rd party code which is more secure than the vendor code I cannot run it. From the perspective of the company, the signature provides vendor lock-in and planned obsolescence in return for a relatively small effort of maintaining code signing infrastructure. So there's only an advantage but no disadvantage. The only possible disadvantage is that I am less likely to buy the product, but regular consumers won't know the difference so the company can ignore me. Omitting hardware components which would help with repair efforts or debugging problems is just as unfriendly. But I understand there can be a huge cost benefits during mass production.