Device ransomware is legal when it's the manufacturer doing it?

One of the most evil recent developments in the consumer technology industry, which has been plaguing certain products for quite some years now, is the phenomenon of a company selling some kind of electronic household "smart" product, initially with completely unlimited access, and then later uploading a firmware update to the device (often without user consent and full knowledge of what the update is going to do) that locks some features of the device behind a paywall.

It is, for all intents and purposes, ransomware: Locking the user out of some features of the device and demanding money to unlock it (and usually not just a one-time payment, but a regular subscription).

It's bad and questionable enough if electronic devices have this kind of limitation from the get-go, since purchase. It's a million times more indefensible if the limitations are only pushed onto the device later, long after purchase. There are many infamous examples of this.

And, apparently, this is completely legal (because the ransomware is uploaded to the devices by the manufacturers themselves), and it's once again a situation where the law is lagging behind.

Needless to say, there have been huge campaigns to criminalize this kind of behavior. You can't just sell a product to a customer promising some features only to lock those features behind a paywall a couple of years later.