Read up on binwalk (and similar programs). I usually carve firmware with just dd.
Often files inside firmware are in upx or gzip format, which is no problem, and other times they are in obscure formats, usually identifiable with
In webroot, you can sometimes find vulnerabilities, and elsewhere you can find e.g. un/privileged accounts. Even if passworded, you can usually crack these accounts.
Dropbear sshd seems common enough that you should take an interest in new vulnerabilities for it, and dnsmasq (quite popular) has also had problems.
I haven't played with JTAG, but it is my understanding you can live patch binaries like
login with some effort. So that's definitely worthwhile, if you have physical access.
For expensive toys like PLCs you can implant arduinos with e.g. LoRa or 2.4GHz modules to just override tripping relays ON/OFF(if you do it really fast, it kills whatever it is driving), and with faster MCUs like Teensy, you can probably interdict traffic on ethernet ports. Concerning powering these MCUs, you can stick a small circuit with 7808 or 7805 regulators in, if there is no 5V rail. Many PLCs run on 24V, which the 78* regulators can run off - you need a few extra caps to catch the spikes, example:
Not my diagram, unsure why there isn't a C1 - here C2 and C3 correspond to the normal C1 and C2. C4 and C5 catch the spikes when the 7805 is powering up. Important!
Also observe that:
W_dissipate = ( V_in - V_out ) * I_load.