Vendors don't need to ship their own images at all. Just let users install stock Debian, then provide a thin vendor package set (kernel, u-boot, DTBs, firmware) tied together by a meta-package. With apt pinning, upgrades become normal Debian transactions, security updates track Debian, and the vendor layer shrinks to a small LTS kernel delta plus boot bits.