If they want to intentionally backdoor it, can't they just release source without the backdoor, but ship devices with it? You can't upgrade them so you can't bu

If they want to intentionally backdoor it, can't they just release source without the backdoor, but ship devices with it? You can't upgrade them so you can't build from source and overwrite. And for such a platform it's unlikely you'd have the whole build toolchain, let alone the environment to get reproducible builds. Even then you have to extract the firmware from the device then try to match it with your compiled binary. Seems like you might as well just reverse the binary and look for backdoors directly?