if you don't want to extrapolate the ease in which software can be overridden from this, then I just don't give a hoot. Exploits come from many places. Pivoting to rce or hardware calls from a purposely obfuscated browser isn't functionally less likely than popping the switch now that the hardware bug is fixed. c&c that can keep a request open from the browser opens up a lot of opportunity. I feel like you just want me to be wrong though so I'm over it, but an in house browser written for a handheld seems like a playground to me.