The solution to this problem are laws that require devices like this to support self-hosted servers for OTA, data, or anything else. You should not be required to use a vendor’s services AND the vendor should not be allowed to implement permanent back-doors.

The problem, of course, is that runs afoul of US espionage and law enforcement demands that they have access to such data themselves.

They want it both ways in a world where you literally, cannot have it both ways. US cyber policy on this front has been a disaster.