I wouldn't be surprised if it were easier to backport kernel security fixes to the version the blob depended on than reverse engineer the blob, given the relatively short life of devices in general.

That said, neither of those two options is easy!