How is this any more insidious than already trusting the company to remotely update code on the device? Or (in the case of Google) on your desktop.

As for the marginal gains you get from a direct SSL connection, at this stage it's been long demonstrated that the average Joe government can get their hands on CA certificates pretty easily.

So the question really is how you expected to benefit from a direct SSL connection, given the already explicit trust you have in the company to provide secure software on your device with which to make the connection?

When a device I own tells me I'm talking to my bank directly, but instead I'm talking to the producer of the device that's a man-in-the-middle-attack in progress.

After that said producer of my device is definitely in my 'to be avoided' category.