These devices are already very weak and many of them even do non-TLS updates with no signing check anyway.

If it has been so weak already, it can't be weaker.

Not always true. I have IoT devices where a valid certificate is useful because the original host doesn't exist anymore and the certificate isn't pinned.

Flashing the devices require direct UART/USB access which may involve soldering, if it even exists. This leak is gold for those because these devices will never get an updated CRL.