Because then most devices wouldn't get updated. Vulnerable devices would stay vulnerable and be reinfected five minutes after they reboot.

If a device has a trained operator, sure, have a write-protect switch.

There's something wrong with "we need to be able to remotely update the ROMs to protect the ROMs from remote updates."

> trained operator

I'm not sure that flipping an "enable updates" switch requires training.

> reinfected five minutes after they reboot

Scenario A: malware installs itself in device ROM. You remove malware, the ROM code reinfects the system. You have no idea if the device is compromised or not. Your only choice is to buy all new components.

Scenario B: malware keeps reinfecting system 5 minutes after reboot. You remove the malware. Reboot. Your system is clean.

I choose (B).

> Scenario B: malware keeps reinfecting system 5 minutes after reboot. You remove the malware. Reboot. Your system is clean.

... for about 5 minutes.

This is very close to what happened with the Slammer worm.[0] It was in-memory only, spread like wildfire, and any unpatched systems were infected within minutes.

0: https://en.wikipedia.org/wiki/SQL_Slammer

You're still much worse off if you suspect the ROMs on your devices were corrupted.

We also demand that people stop using C, and languages that follow similar safety philosophy, but alas it is talking to windmills.