Reproducibility is one segment of open-source code. It's one of the conditions to be considered open-source, but not the only one. In an open-source world, you would be able to take any such code, modify it, better it, change it, put it in your product, and sell that product. If someone finds what you did useful, they could take your code and do the same, or just copy it in its entirety with no or minor changes. Coldcard doesn't allow anyone to use their codebase in the products they will later sell. But the funny part is that they built their own hardware wallets on open-source code written by others.

How many updates are really needed in an airgapped wallet like the Coldcard? It only supports Bitcoin and is a simple signing device of transactions that are later exported and broadcasted elsewhere. Are your devices not working as they should for some reason that would warrant a fix in the form of an update?