How do you see this being viable without completely compromising the security of people who, for whatever reason, still use those devices?
My claim isn’t “it’s impossible to implement a secure bootloader that also has escape hatches”. I’m saying it’s borderline impossible to do that retroactively for a fleet of obsolete devices, in a way that doesn’t compromise security of those.