I am not saying it is easy, but an open device can still leverage a secure element, sandbox any applications and have granular permissions.

Just like PKI infrastructure, vendors could embed and tie into a TPM similar key infrastructure that would be the only part you couldn't touch (key storage + key validation and signing implementation so it can't be tampered with). I mean, even there the code could be open and only the key material would be secret.

(I find revocation a harder problem, really)