There is no obligation to upstream anything after all, you just gotta provide the code if someone asks... And why would you care as a user?
You might want to give out or sell customized devices, adapted to the specific user or deployment. The end user typically only wants the binary, so distributing the source is at best a good-faith-waste-of-time and at worst an opportunity to cause support problems.
The example I'm thinking of is keyboards running QMK firmware-- it's literally customized by editing a bunch of C and recompiling.
GPL violations happen all the time but they rarely get caught.
It's really not. The GPL requirements, AFAIK, only come up if you're distributing binaries and refusing to give source to people when asked (or, in v3, if you stop people from building and running that code). The only situations I can think of where that would even come up are situations where you're no longer acting as a user. So humor me; what exactly could a user do to violate the GPL?
Note that you can find whole textbooks on what constitutes “derivative works”, but in any case it’s much broader than just forking a library. Basically any software that integrates the GPL licensed code (other than integration by way of loosely couples interfaces communicating via other means) is a derivative work.
For example, when your enterprisy application bundles and uses a GPL library to generate PDF’s of some of its data, the enterprisy application as a whole typically becomes a derivative work, which means (11) you must distribute the source of the full application together with any binary distribution of the app and (2) that source must be licensed under GPL.