A few reasons.
#1) The Photon has ALLOT more to offer than Arduino does. Now i am entitled to my opinion here, so don’t any one slam me for saying this. IMHO, Arduino is a royal joke, the IDE is laughable, and I would laugh any any engineer that would stick an Arduino board into a commercial or industrial product.
#2) Many locations do not even have a cellular network. Not to mention the cost of adding something with a sim card for data just for the rare update would not justify the cost.
#3) If you are a company that makes many products that all require a micro of some sort. Its more economical to try to use one platform and stock that in bulk than 12-15 of every other kind. Not to mention code portability using the same micro and IDE from project to project save allot of time.
Every location has what is called a bungalow. You see them all the time mainly at every RR crossing.
They are all locked & secured. One would have to break into one of them, take the lid off one of our devices, know how to put it into AP mode, know its browsers IP address and then do what? How are you going to hack it even if you know that stuff? All you can do is upload a file with a user name and password that locks you out for 30 minutes after 1 wrong entry. A man in the middle attack is really pointless because in the 30 seconds it takes him to turn the AP on, and upload the file the AP is off. So even knowing what they did is useless for the hacker because the AP is now off, and wont be back on again if and when another firmware needs to be updated.
Lastly, and most importantly why AP mode is my favorite thing to do is for the device setup. Many devices need a OLED, LCD, VFD, keypad, and buttons to set up parameters for the device. This is a huge cost for the product. allot of money can be saved by simply creating a web page interface to do all these same things. Turn on the AP, browse to the device’s IP and boom, you have a beautiful looking GUI to set up the entire device once you click save, AP is off.
Now, we are getting off topic. Its not about why i want to do what I want, its about has anyone does it before. We also use the ESP32, and firmware is uploaded this same way but the only difference there is that its https.