It most certainly doesn't have to be intentionally insecure but it almost definitely is accidentally so. There should be no OS nor network stack running in the firmware, period.