>Do they mark updates as fixing security bugs? (If not, they care more about hiding security issues than fixing them)
Sometimes device updates are marked with "fix" to protect users. Even if iot devices automatically patch themselves, an entire managed fleet does not get patched instantaneously. In my expirence there can be a significant long tail to 99.99% (you never actually get 100% updated). There will always be some percentage that are offline and thus vulnerable to a bug. Not drawing attention to something significant is not alwaysa choice of a fully self-serving nature.
Generally agreeing except for one point
Sometimes device updates are marked with "fix" to protect users. Even if iot devices automatically patch themselves, an entire managed fleet does not get patched instantaneously. In my expirence there can be a significant long tail to 99.99% (you never actually get 100% updated). There will always be some percentage that are offline and thus vulnerable to a bug. Not drawing attention to something significant is not alwaysa choice of a fully self-serving nature.