Presumably a state-level actor could not only figure out how to disable these devices, but actually create patches for the vulnerabilities and force-distribute those patches. They would have access to test hardware and could even demand confidential documentation from the manufacturers to facilitate this.