Maybe I’m pessimistic, but I think It’s going to be a lot worse then what you stated. The embedded guys are not going to change their ways, unless the law of the land says they have to or reputation damage is to great. Those are both governed by public opinion.

But there will be an other model, also not really all that great. You will have to pay for it like a ‘cloud service’ or a phone which keeps the device not only updated. But when you stop paying the device stops working: http://www.theatlantic.com/technology/archive/2014/09/when-everything-works-like-your-cell-phone/379820/?single_page=true

You might get the device for ‘free’ if you get a contract for an initial period that is long enough.

(side note: also I know Bash Shell Shock is just an example, but in real life, you wouldn’t actually see a Bash-shell on an embedded device. Most of them use BusyBox)