For the firmware case specifically, some embedded processors support encrypted, signed firmware and encrypted memory. The physical defenses of the processor would need to be defeated to recover the unencrypted binary. That's not impossible (defeat of protections on game consoles being an example) but it would take physical access to the hardware and specialized tooling to even attempt.

Maybe that's a possible future? Chips are not that expensive compared to the price of an app so each app can come on its own SOM in a cartridge to run its core logic. The computer just serves as a terminal and auxiliary compute server to the app cartridge.