ISP will not update customer owned equipment

If it is part of the DOCSIS 3.1 spec (and that it specifies that firmware MUST NOT be updatable by the end user), then Netgear should explicitly state that on their download page(s), preferably with a reference to the particular DOCSIS document and section number.

I just perused several of the DOCSIS 3.1 documents, centering around CM-SP-CM-OSSIv3.1-I22-220216: Cable Modem Operations Support System Interface Specification, and could find nothing that addressed this.

I would like to get such a reference.

Note that this approach has serious security risks, given that a malware-containing firmware version could be introduced either by the ISP or by a third party getting access to the cable network upstream of the cable modem. Since the end users cannot access the firmware to perform a clean install, they may rely only on the reported firmware version, without even the option of checking and verifying checksums for what is installed.  One would think this would introduce a substantial risk for the ISP, since they would be totally liable for any such malware being introduced, without giving the end user any means of checking this themselves.