If you deploy a firmware update it contains new instructions that can do anything. The problem is the hardcoded credentials that an other 3rd party could dump f

If you deploy a firmware update it contains new instructions that can do anything. The problem is the hardcoded credentials that an other 3rd party could dump from a device and then could be used to attack other devices. What they should have done if they wanted automatic updates was just have a public key on devices. They could then sign any updates with their private key. Still with automatic updates you have to trust the vendor. However, with what they did updates/commands could be coming from anyone willing to dump device firmware.