Basically, GPLv3 has a requirement that you need provide your users instructions for modifying/replacing any GPLv3 software that ships on a device that you sell

Basically, GPLv3 has a requirement that you need provide your users instructions for modifying/replacing any GPLv3 software that ships on a device that you sell. That means, in essence, that your users need to be allowed to install modified versions of any GPLv3 software. As a consequence of this, you can't have signed/encrypted firmware unless you provide your users with the private-keys. You also basically can't stop people from inspecting/modifying any secret-sauce parts of your design, at least not without jumping through an awful lot of hoops. Because if your users must be allowed to install a modified version of Bash (for example), then all bets are off for what they'd insert to get access to the rest of your filesystem. Lots of companies have IP that they want to protect. Maybe it's DSP modelling plugins that your engineers wrote. Maybe it's programs that access private APIs on the company servers. Maybe there's shared firmware across products in a feature-differentiated product family. Maybe there's a legal requirement that customers can't modify your firmware, for something like FCC or FAA compliance. None of these kinds of models are feasible if your users can modify your rootfs. So in essence, it means your product can't include GPLv3 software if you also want to ship IP that you need to protect. When GPLv3 was released, the FSF basically pushed it onto every GNU package. Which they could do, as owners of the copyright on all code in all GNU-managed projects. So that means bash, coreutils, make, bc, find, grep, sed, gawk, libtool, gpg, gzip, tar, wget, etc. And also more subtle items like readline, which finds its way as a dependency into all kinds of things. This essentially meant that all of it became verboten for lots of developers to include in their products, forcing them to move to alternatives like Busybox.