We have worked very hard in the OpenWrt and Linux projects to make it easy to update them in the field. Linux distros, android, apple, openwrt, etc have this facility built in now. IoT should also.

Devices should have the ability to run whatever software the user chooses. My point is that simply allowing this isn't enough to ensure those devices are secure.

but that's just because manufacturers desperately hide the fact that their own firmaware is based on OSS, and that there are alternate stacks available.

imagine instead that vendors had to acknowlege the structure of their firmware, and make the (usually obvious) hardware interface documented from sale. that would automatically solve the issue of out-of-support(-by-vendor) hw.