I am not alex, but I am a software security guy, and have worked with bounty programs, bug reports etc extensively. I can only guess, but I have seen these kinds of reports from both sides and know some patterns in responses.
There's not much technical risk for Canon here, but there is some PR risk. Tech-wise, their dev teams will hopefully get more time / money to improve quality in networking code, as well as removing ability to do a silent firmware update without physical access (this last part especially! Why does PTP allow this?). This would have no impact on ML. They may choose to make firmware updates generally more difficult / authenticated to perform, but I would guess not; there's not much value for an attacker in firmware update attacks that require physical access to typically consumer, typically non-networked devices that don't hold business critical data. And if you do make updating firmware harder, useful updates are harder as well as higher risk (which means higher testing cost) that you accidentally break cams in the field - which customers really hate. The dev team product manager probably just wants to fix the specific bugs, maybe harden the code in that area, and then get back to the massive backlog of known bugs, feature requests, new versions for new hardware, etc.
*If* management judge the PR hit is sufficiently bad that they need to have a big visible response to reassure customers, then it's more likely ML and other after-market players will see problems. I don't think this is likely in this case. It rarely happens with non-networked consumer devices, most buyers simply don't know or don't care, so companies aren't motivated to make changes (which is honestly reasonable; it means buyers get the things they want, cheaper). With stuff like phones, routers, PCs, there's more media coverage, and the impact is bad enough if it does get exploited, that consumers get scared and management drives bigger changes.
TL;DR - low risk ML gets shut out, but we can only guess.
