Vendors have enough control about locked-down devices that they could play ransomware and make arbitrary demands to their users without many problems. And "device" can be anything from phones to cars to smart homes or expensive specialized equipment.
I'm not sure how the legal situation is currently, but since the Stallman strategy of keeping devices free has evidently failed, I think it's high time for a comprehensive set of "digital consumer rights" that limit what vendors can do on "their" devices.