Broadcom just makes the chip right? So customers in this sense would be the router OEMs like netgear who may not have distributed the new update to end devices.
And -based on the email- the SDK used by folks who use that chip in hardware, yes.
So, yeah. The customers are the folks who build the hardware that uses that chip and the relevant parts of Broadcom's SDK as part of the software loaded into that hardware. Though it could totally be the ISP's fault for not testing and deploying updated firmware for affected CPE. There's not enough information to know exactly who is at fault, but it doesn't look like it's Broadcom.
Since they wouldn't share the contents of their notification to their customers, we don't know how clearly those customers (router makers) were notified. But having a CVE and detection signatures would get this vuln into all the usual scanning and reporting channels, which is another route the customers might (should!) be paying attention to.
Also, I don't know how laws over there work, but there might be legal requirements to patch things once they're known, where "known" is probably defined by "has a CVE issued". So by refusing to issue one, Broadcom is blocking that process.
How is that blameless?
One would imagine that both what Broadcom is obligated to do and the definition of "legitimate vulnerability" depend on the contracts between Broadcom and its customers, as well as the relevant laws and regulations, no?
> How is that blameless?
I'm going to ignore your speculation about hypothetical legal requirements that neither of us currently know anything about.
We're here talking about faults in CPEs nearly a decade after Broadcom released a fix for those problems and announced the availability of the new SDK version its usual channels. Broadcom also _claimed_ that they notified affected OEMs. [0]
You may disagree, but I'd say that if you have an in-support product with field-upgradeable software, and you don't bother to check the release notes and support status of the software components you have loaded into that product at least once every year or so, then you're definitely to blame. This goes double if you've been notified by the vendor of a vulnerable component that it's vulnerable and there's a fix available.