> and that's because the closed source Mali GPU drivers only work on a fixed kernel version: 4.4.

There's an easy fix: add a fourth ChromeOS software channel (currently there's stable, beta and dev) that ships an image without a GPU blob and with a modern kernel.

There are plenty of users willing to disassemble, disable write-protect, flash new firmware and re-enable write-protect.

Inconvenience, and disabling hardware acceleration for video decoding is a small price to pay for security.