Looking at that list, collapse OS seems to cater to 8-bit only. It’s also aimes at “ built from scavenged parts” boards. I’ve often come across Hitachi h8, Blackfin, PIC, avr, the occasional ARM and other controllers in the wild. But they all have one thing in common: the flash is locked and inaccessible without some jtag tools. The only times you’ll see external flash (winbond & co) is with an fpga or a controller who’s had his otp memory configured with a bootloader.
I often re-purpose scavenged board because of their useful layout, but only after swapping the controller for a programmable one. The notion of scavenging the controllers themselves… far less practical as you think.
The iot devices are hacked on the application layer. You have a controller running some linux distro and you work your way in over tty/telnet/eth. That’s an entirely different ballgame than repurposing 8-bit avr or 32-bit STM microcontrollers.
I often re-purpose scavenged board because of their useful layout, but only after swapping the controller for a programmable one. The notion of scavenging the controllers themselves… far less practical as you think.