I don't see the conflict. If it important that the device can prove its authenticity to some centralised service then yes, it is likely that the consumer can't

I don't see the conflict. If it important that the device can prove its authenticity to some centralised service then yes, it is likely that the consumer can't also modify that device. But how many devices really need that level of attestation? Does a tractor need to be able to prove to John Deere that it is a genuine unmolested vehicle, or does it just need to prove to JD that an active subscription is in place for whatever remote service is being used? If just the latter, then we can still have encryption, no problems. That's just username & password over TLS, same as we have been doing for decades on untrusted endpoints.