[rhn_mk1]

"All in all, we didn’t find any critical security issues during our investigation. Though there is probably room for improvement in a few areas. For example, we would have had a much harder time getting root access"

This always gets me: "secure" meaning "the manufacturer remains the owner even after selling the device".

What does getting root access have to do with security? Does the threat model include the buyer of the device? If the box is physically opened by a random person, the damage has already been done - they can mess with the electrical installation already. What's the benefit of hiding the software in that situation?

Exercise your rights as the owner and ask for the sources instead. Linux is covered by the GPL.