Yes if an user program like flash results in pwning the device, security model is broken. Ideally when a user level program is compromised it should not be able

Yes if an user program like flash results in pwning the device, security model is broken. Ideally when a user level program is compromised it should not be able to impact OS in any condition if security architecture was adhered to as it was envisioned. But every single OS out there have chosen the easyway out. On hardware level CPU rings exist to protect kernel from rogue programs and each other but in reality all that protection is either completely or partially circumvented. I read a paper on this a year back. I will try to find the link and post it here.