Good point about commercial/industrial devices. For consumer products, we are both right. A consumer product developer must provide owners with any secrets/key

Good point about commercial/industrial devices. For consumer products, we are both right. A consumer product developer must provide owners with any secrets/keys/code necessary to replace any of the GPLv3 software. So: rights to modify the rootfs. It's OK for the product to complain at you for doing it, but the vendor has to tell you how, if you ask. And give you any signing keys. That's not ideal on products that might have software-unlockable features, or on public-facing things like routers.