Yes, the developer is the grantee in my comment.
Though even the "user" might be harmed, because you might get a device shipped to you with what-was-previously-copyleft software, and now you can't ask the vendor (also the "user") for copy of the source code since they can claim "we are using it under the terms of v4, sorry".
Yes, that clause hinges on both parties trusting the FSF to adhere to free software principles. So far this has been an extremely good assumption.
Good point. IANAL, but I think that is more murky terrain. Downstream redistributors like the vendor are not allowed to remove copyright notices, so I think the notice to get it under the GPLv2 or later is passed to the user as well. Not sure which one would weigh stronger then, the copyright notice or the claim of the vendor to ship under a newer version of the license.
Another question is whether a newer version would even apply if it was not in the same spirit as the included GPL version, since the license also states:
The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.
Again, IANAL, but I always felt like many of the parts of the GPL are ambiguous and the interpretation would only become clear in a court case.
For the GPLv2 there is already a lot of malicious things a vendor can do anyway. In contrast to the GPLv3, GPLv2 does not have the 'anti-tivoization'-clause. So, even though the vendor may be required to provide source code, you may not be able to run the software with your modifications anyway, because the vendor uses a bootloader that will only run software that they sign.