alt Hacker NewsGood point. IANAL, but I think that is more murky terrain. Downstream redistributors like the vendor are not allowed to remove copyright notices, so I think the notice to get it under the GPLv2 or later is passed to the user as well. Not sure which one would weigh stronger then, the copyright notice or the claim of the vendor to ship under a newer version of the license.
Another question is whether a newer version would even apply if it was not in the same spirit as the included GPL version, since the license also states:
The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.
Again, IANAL, but I always felt like many of the parts of the GPL are ambiguous and the interpretation would only become clear in a court case.
For the GPLv2 there is already a lot of malicious things a vendor can do anyway. In contrast to the GPLv3, GPLv2 does not have the 'anti-tivoization'-clause. So, even though the vendor may be required to provide source code, you may not be able to run the software with your modifications anyway, because the vendor uses a bootloader that will only run software that they sign.
* A German court process found that the GPLv2 does have an anti-tivoization clause
* If the FSF published something clearly against the spirit, like "Microsoft can take ownership of your IP", it is not clear a judge would allow this. If it's within the same spirit, like "you agree to allow forks that aren't substantially different to use your trademark", they probably would. Legal loopholes aren't like computer hacking, they are social engineering.
* If I can use it under GPLv2 and GPLv2 allows me to redistribute it under GPLv2, then I can redistribute it under GPLv2. "Or later" means that I can pick a version to comply with, not that I have to comply with all of them simultaneously. So I can always remove the "or later" clause. I can also change it to "GPLv3 or later" since I may choose to comply with any subset of the allowed licenses (here all of them except for GPLv2).