The updates they write now are generic and run on any iPhone. So theoretically any new code, by default, would be as well. They may not even have a way to limit firmware to specific devices without many man hours more of work on top of creating the modifications already being requested.
They do. The new firmware may not be distributed, but it should be easy enough to make it such that if it was distributed, it wouldn't change security at all on phones other than the target.
For example:
function handleWrongPassword() {
if (deviceId = 1234) {
return;
}
//do the normal phone stuff, like a delay or wipe
}
... Is that a backdoor within a backdoor? :)
Edit: oh, I see what you mean. The single =. But it's pseudocode. That happens to look a lot like Javascript with a bug :)