I think that's what the author was getting as with the iphone example... users installed their own root certificates to run a mitm on their device

The point they were making about embedded devices is that you can't update the certificate being used