On reset it should still verify the server cert when it tries to call home, but since you have access to the image you can replace that (if they didn't stash it somewhere securely, that is).
The sign did use AWS IoT for real time configuration updates however initial configuration was pulled from their HTTP server. Using the vulnerability I describe in the article I just remove the connection to AWS IoT.
This is just straight up gaslighting. “That thing you said you did isn’t going to work”.
If you had read the post, you would have seen that they did, in fact, not “do things correctly”.
If you needed to update the CA, you'd need a firmware upgrade, served with a certificate signed by something chained to the old CA. And then, more likely than not, you'd want to do further updates on a new hostname, because it's hard to do a single hostname and send the right certs to the right clients.
This is a giant pain, and I don't blame people for using public CA infrastructure instead. Especially if your company goes bust, who cares?