Yes, but even if your standard only states that manufacturers have to provide some sort of resilience to attackers modifying the binaries on the device remotely

Yes, but even if your standard only states that manufacturers have to provide some sort of resilience to attackers modifying the binaries on the device remotely, I suspect many manufacturers are going to go with the simplest way: preventing any modifications save manufacturer-signed updates, and/or reducing user configurability of the device. My feeling on this are somewhat mixed; on one hand virtually everyone who owns a modifiable device never makes any significant modifications and doesn't know how to properly secure it to boot. On the other hand, that means that even if manufacturers had no selfish reasons to put in such limitations of their own volition, the natural state for most consumer device markets is going to be to have no modifiable devices available for purchase just because making an unlocked version isn't worth it.