I didn't write this with anything specific in mind; it's based on a binge of Defcon videos from at least a year ago - consider that my citation.

Honestly, anyone that invests the slightest amount of effort in researching how vulnerabilities are found could arrive here. I'm surprised there's skepticism, quite honestly.

It often comes down to the would-be attacker downloading a published update, looking around the PHP or whatever within, and finding unprotected or bugged APIs to leverage -- often to write their own modified version of that same update.

Well if I re-read your comment, you technically don't say anything too controversial: "so many" isn't really countable.

But the implication is that compromises were found because those firmwares were open and/or that closed firmwares suffer fewer similar compromises. Which is what I would question.