I have seen this quite often in legacy devices. 20 years ago there wasn't ida-pro, and the designers probably felt more secure about leaving all the pieces of the puzzle in the hands of the enduser. Real cryptography was more difficult on 8 bit hardware, as well as being export-controlled.

The last one I encountered was an s-box, where the s-box material was included in the update file. The only secret was the initial substitution ('seed' if you will.) They kept it in firmware until the very last product to use this scheme, whose windows app decrypted the update to learn some details about the update before it was loaded into the embedded device.