I think the parent comment is implying that if the source code is released at the end of the device's supported life, it will be much easier for hackers to find

I think the parent comment is implying that if the source code is released at the end of the device's supported life, it will be much easier for hackers to find vulnerabilities. Then users who aren't paying attention will continue running that last version, and hackers will attack them using those now-public vulnerabilities. So you'd still need some mechanism to force-update devices in response to vulnerabilities found in open-source end-of-support firmware.