> Additionally the OS may have additional protection measures, such as signing each binary, signing the booting image and limiting which syscalls can be done by any binary.

I'd love for that to be true. Unfortunately, a lot of consumer routers are fairly straightforward Linux systems with no particular attempts at hardening.