The new regs themselves do not state this requirement. It lists several possibilities for manufacturers to guarantee conformant emissions from their device, several which will continue to allow 3rd-party OS firmware.
Admittedly, the brave new world looks like region-locked devices and cheaper routers that truly are locked down in the exact ways we don't want, but that is not a hard FCC requirement, just a side-effect of the new regs on APs that have poor separation between OS and radio module.
There are plenty of uses for radio software that don't involve going outside approved frequencies.
Except unlike ISM bands, U-NII 5GHz spectrum has been carved up with consultation of the 5GHz primary (licensed) users in each country and granted exclusively for U-NII conformant devices.Unlike 2.4GHz ISM, nothing gives you the right to transmit on 5GHz U-NII bands (well, there's a bit that overlaps with secondary amateur spectrum) than otherwise permitted through the same FCC approvals process every device manufacturer must undergo.
That was the case before the new rules. Now the new rules are imposing sucky requirements for U-NII device software security.
However, that's been largely misinterpreted in every discussion I've seen recently.
For some context, check out https://wirednot.wordpress.com/2014/01/07/what-else-is-in-th...
You really don't want U-NII devices configured for Japan to be stomping on licensed spectrum in the US; you also need all that power negotiation, radar/interference avoidance algorithms in your radio so we don't get the same 2.4GHz mess happening in 5GHz.