Companies want to build product identities that can last for more than a year, but also want to be able to react to changes in the supply chain. Fixed BOM guarantees really aren't viable in this product segment, but you can often get such assurances in the enterprise, industrial or client OEM SSD markets.
Most of the time, swapping in a newer generation of NAND flash memory is a net improvement for a drive's performance and power efficiency, but when the newer generation increases the capacity per die there will almost always be a downside in some corner-case benchmark. Those swaps aren't worth worrying about, unless you're trying to abuse a consumer SSD for the kind of workloads enterprise SSDs are designed for.
Likewise, controller swaps are usually nothing to worry about—aside from some instances where performance downgrades stemming from NAND downgrades have been misattributed to a controller change, the most harmful examples in recent years have been when the amount of DRAM is reduced from the usual 1GB per 1TB ratio down to something more like 256MB per 1TB. The consequences of such a change are easy to demonstrate with synthetic benchmarks, but almost impossible to measure let alone notice for real-world usage patterns. Other times, a controller "downgrade" simply swaps in a cheaper controller that is still more than fast enough for the NAND to be the bottleneck.
It would be nice if we could universally get more detailed spec sheets and a guarantee of a new consumer-visible model number when the major components change, but the consumer SSD market has proven too price-sensitive and the technology and supply chain too dynamic for that to be a competitive business strategy. For the most part, you do get what you pay for, except that a few of the top brands also command an undeserved price premium.