It doesn’t even need to be a killswitch. If the hardware checks firmware signatures (as it reasonably should), then I can just hold a critical patch hostage. You can’t patch against some nasty bug until $DEMAND is met - and meanwhile I can sell the exploit to some other enemy of yours and let them have fun with your systems.