"By provenance, I mean where it's designed, where it's manufactured, who has brand oversight of it, who controls the firmware, who runs the IoT phoning-home servers, etc."

Arguably the most important area of "provenance" is who controls the software ("firmware"). (Perhaps the hardware owner should control the software, e.g., compile and install OpenWRT.) The report on which this submission appears to be based mentions "command injection" as the vulnerability being exploited.

https://www.cyfirma.com/research/comprehensive-analysis-of-c...

https://www.microsoft.com/en-us/security/blog/2024/10/31/chi...