Rust isn't magic. And you can write CGIs in any language. Shouldn't we also ask why are they using their own web server? or why a company with millions of devices deployed has done little testing?
Let's not going to that debate. It's a good start to improve security postures, regardless how you spin it.
But more importantly, my point is why are they doing CGI at all?
BTW quality of embedded webappa is mostly sucks.