> But for safety reasons, since the software controls when the toaster pops, you decide to check at boot time that the software hasn’t been modified.
As arguments go, this is a pretty weak one considering how obvious the solution is: Make the manufacturer not be liable for what happens when you operate the device with unauthorized software.