> Broadcom just makes the chip right?

And -based on the email- the SDK used by folks who use that chip in hardware, yes.

So, yeah. The customers are the folks who build the hardware that uses that chip and the relevant parts of Broadcom's SDK as part of the software loaded into that hardware. Though it could totally be the ISP's fault for not testing and deploying updated firmware for affected CPE. There's not enough information to know exactly who is at fault, but it doesn't look like it's Broadcom.