[ClumsyPilot]

"Usually just a small embedded application in an RTOS, without much security at all."

In security, that's probably a strength, not a weakness, if done right. There are less lines of code that might contain vulnerabilities. There is no random side service, JS library or OS vulnerability to attack, there might be nothing to listen for incoming connections, etc.