This was only found because LG was stupid enough to use plain HTTP instead of HTTPS. I wonder how many devices use SSL/TLS for this same thing that just haven't been caught yet.
http://www.popularresistance.org/new-intel-based-pcs-permane...
http://semiaccurate.com/2012/05/15/intel-small-business-adva...
Now on a closed device it can be very difficult to add root certificates to the store, but it's often possible.
For instance when the PS3 firmware was first cracked I took the opportunity to flash mine with a firmware I made that contained my root authority certificate. Then I wrote a python program to intercept and MITM all the traffic.
Result? I found out that on boot your PS3 tells Sony every game (or other thing) you run on the ps3, what times you run them and how long for.