[mindslight]

Often, including in your example, "legal requirements" just means the risk-adverse desires of the legal department, which doesn't really address the core concern of why a company should be forcing users' devices to implement the company's desired policy post-sale.

Furthermore in the case where there really is law passed that mandates device firmware be updated to certain functionality, the ability of the manufacturer to force that update onto an end user should be viewed as a security bug in the original firmware.