> Remote update mechanisms can themselves present security problems in some domains.

I've proposed many times that the device have a physical write-enable switch on it, not a software switch. That way, a malware infestation won't survive a reboot, and your backup hard drives won't get compromised.

I'm amazed that nobody does this. (Hard drives used to have a write-enable switch on them.)