That's an interesting project. Thanks for that link.
Insecure infrastructure (and other gadgets, like home routers) is such
a problem I hope the CIP project can get funding from places like the
National Science Foundation or Homeland Security (in the US).
Maybe the GPL license needs an update that addresses the abandonware
problem. The update clause requires vendors on top of the base system
to provide updates for the life of the device. Something like, "GPL
plus the update clause".
The update clause will ensure vendors fix their bugs and send them
upstream. The update clause won't affect the kernel because it is
being updated.
Jeff