How can I confirm what runs on what?

Not so over the top given the evasive nature of your repeated lack of detail coupled with the fact that you've had a working build system up for some time now and could build from source your "special" code, if you had it.

So there clearly is a lot more "open" on these devices than a known-vulnerable version of dropbear. You may not be concerned about security, but you put your "group of friends" at risk, as well as everyone else on the Internet. Just for one, read