This is pure speculation, but if I had to guess, I'd bet they baked a Symantec-owned root into the product without an upgrade path, and they use a third-party p

This is pure speculation, but if I had to guess, I'd bet they baked a Symantec-owned root into the product without an upgrade path, and they use a third-party provider who is moving their endpoint away from Symantec (or one of Symantec's other brands) because of the big distrust that's happening next month due to all of their misissuances. That means the devices won't be able to connect to the endpoint once the cert changes.