Earlier quoted context omitted.
Or a deliberate security measure. Embedded devices often use Harvard architecture, with separate memory for code and data, so not allowing remote updates makes remote code execution impossible.
Sure, but there are at least two other options that are essentially as secure, assuming the “remote attack” threat model: 1. Allow customers to download updates and flash over USB. 2. Boot device into a limited mode that allows signed updates. Certificate should be stored in secure memory.
I.e. low wage, minimal training, not technically proficient users with unsupervised physical access to the machine
A machine through which a large amount of cash (virtual or otherwise) flows.
The criteria of (a) being updatable by a semi-technical customer & (b) being secure against technically malicious or socially engineered ignorance attacks seem challenging to simultaneously satisfy.