If you controlled a piece of hardware, you may not have had a choice to upgrade.
The lesson is that closed-source is anathema to a good security policy.