IMO they should have a choice between open source that can be updated out of band from the manufacturer or assuming direct liability for issues for the product's life.