You'd be surprised at the amount of effort to apply upstream patches or fixes to older vendor software. Many vendors also maintain older forks indefinitely. I've spent an inhumane amount of time applying/porting modern security fixes to ancient codebases.
The root of the problem is: you buy a part, and to use the part you need some software to talk to it. The vendor, along with the part, supplies you with some sample code, which uses some ancient kernel and ancient GPLv2 utilities. If you use their code, then you perpetuate the problem. If you choose not to, then they won't help you when you have issues.
Why do vendors use such ancient software? Vendors care deeply about their IP, and to some extent tivoization does happen with individual products, but more usually through obfuscation. Not a whole lot of open firmware for wireless chipsets, is there?
Customer demand can change things, but vendors are afraid of their customers stealing their technology, and taking it to a cheaper competitor, or building it themselves. This stuff happens all the time. So they give you some code that talks some foreign language to their part or give it a seemingly black box blob of code to run and suddenly it's a black box to you too.
Patents (for hardware), and China's lack of concern for IP theft are the root of all of this.