Anyone doing this in a serious fashion will have something similar to this kind of setup: Device has a per-device key burned in at the factory and the private

Anyone doing this in a serious fashion will have something similar to this kind of setup: Device has a per-device key burned in at the factory and the private keys sit in a manufacturer HSM. Updates are signed by the manufacturer and also encrypted with the per-device key for each device. The device itself will have tamper-proof (well, as tamper resistant as they can be) chips and a secure boot-loader that will do all the dirty work. Nothing is ever 100% secure, but you shouldn't believe it is something similar to a piece of software on your computer where it is just "hit this https URL for the executable and run it". Or maybe you should believe that and force manufacturers to come out and state otherwise :)