Devices that can be made to update on the whim of some corporation (which can be compelled by the government) are also not at all secure.
I don't consider my house secure if the lock company and the police have a skeleton key to my front door.
Open devices that can use open protocols are best. That is why they are trying to deprecate them.
I don't think it is at all far fetched. We've already seen domain registrars in the United States arbitrary delete domain names for purely political reasons that they made up on the spot. Why not revoke certificates from websites that they find objectionable?
It's not like most users would know how to force their device to connect anyway. On many Android devices, it is virtually impossible to force your browser to connect to a site Google doesn't want you to. But they've gotten this far because we trust them to only protect us from malicious sites.
Am I being paranoid for not trusting Google, Facebook or the federal government?
Unsecure http is essential to the free flow of information.
Let's get the right solution before we force everyone to use it.