That assumes that 1) the device doesn't require signed blobs, which would prevent you from putting your own code on it (easily), and 2) that their own component

That assumes that 1) the device doesn't require signed blobs, which would prevent you from putting your own code on it (easily), and 2) that their own components are open source, thus patchable without wrapping the service or patching the binaries.