Piracy is no concern as long as there is just really basic access control to stop i.e. random end-users that might know someone who works at said place from dec

Piracy is no concern as long as there is just really basic access control to stop i.e. random end-users that might know someone who works at said place from deciding they want to transform their X into a Y using a flashtool. But also another and more important reason you can't have people cross-accessing firmware images would be because certain firmwares would contain blobs that are considered IP of certain joint partners in a project. So yeah, piracy is not a concern, and I'd be completely OK with just manually allocating who can see what. It's for factories and not consumers. Also hypothetically, if you were really persistent, you can flash the wrong firmware files onto the wrong hardware and hypothetically you could accidentally sell it to someone. And that would be an absolute nightmare that I want to avoid as well. The application is sort of similar to flashing engine tunes onto a car and not necessarily hardware variant A/B/C etc. But there's potentially soon to be hundreds of variants and the end-user could very easily get lost. (At this point it's a UX concern)