[petra]

You could get your operating system from one vendor, while the application code be inside of an isolated container from the product vendor, with you easily controlling changes to each one. Same could go for the cloud.

I think Android things is built around this idea, with manufacturers having no control on security updates.

For simple, standalone features, this could work well. But when your features are dependent on interacting in some way with other people's connected products, this might not work.