* standard install, strip down kernel to bare minimum, configure everything
* mount everything read only (/var memory backed)
* set kern.securelevel to 3 (to disallow raw writes to disks, modifications to the firewall or un-/loading of kernel modules)
* ignore the on-site admin when he begs for ssh access (because you of course disabled sshd)
The system was first rebooted in, IIRC, 2004 when I had to change the ppp-config after they changed providers.
Overall costs: about $100 for old hardware and about 1h of my time.
http://securityrouter.org/wiki/Pricing
eracks.com offers preinstalled obsd firewalls
Probably many others, but if you mean store bought consumer devices no idea but would be trivial to abstract away the OBSD complexity and offer secure remote updates if a company wanted. Why they don't, maybe it's cheaper or easier to find GNU/Linux engineers.
They really don't.
Thus the growth of systems like pfSense.