A lot of the security features on microcontrollers are poorly implemented. Here's an example where someone recovered the encryption key on a consumer device with encrypted firmware: https://garyodernichts.blogspot.com/2024/10/looking-into-nin... . The microcontroller supports firmware encryption with a 128-bit AES key, which gets written to 4 32-bit write-only registers. Because it's split up like this, it's possible to find 1/4 of the key by writing every possible value to one of the registers and checking that the output matches, before repeating with the other 3 registers. This means that the number of possible combinations to check is reduced from (2^128) to (4*(2^32)), which can be brute forced in a few hours.

I agree it’s not great, and finding an MCU that does this well is challenging. But that may just become a hardware design constraint going forward.

It’s not clear to me what else one can do to protect this kind of IP if you want or need to do the processing on-device.