> Someone would have to dump the firmware to find out, but it would be trivial for each device to generate their own salt - making a potential lack of rate limit a non-issue.

Salting does nothing to protect against bruteforce attacks, which are what rate limiting defends against. Salting is done to protect passwords in the event the password data is stolen.