The console itself has a security processor that's got a private key burned into it's read only memory (ROM). This allows the console to verify (and thus, play) games that are inserted into the console from discs or to verify the authenticity of digital games while offline. This has to be possible unless Sony is ready to require an internet connection and disallow any offline play.
As it's engineered now, you can purchase a PS5 console and a game on a disc, never connect it to the internet, and still play that game. The console itself is the state of authority to determine what is genuine, such as the game on that disc. If they used a central online public key, the console could potentially be hacked using a man-in-the-middle attack that would tell the console that arbitrary code was actually valid.
They can absolutely patch this with a firmware update by generating a new security key and flashing it to this chip, but the problem of being able to run existing disc-based games offline (as I outlined above) goes into a catch-22 state. If you change this key, all existing disc-based games will now be considered unauthorized code. Every game (both disc and digital) would also have to be patched online to work with the new security key. Trying to run a disc based game offline (without the latest title update that has the new keys) on a patched console would throw an error.
They'll have to weigh doing this against the potential fallout of piracy vs the number of customer support issues they would face. Either way, this means people who are offline or on a firmware version that hasn't patched the new security key should be able to run whatever code they want. Having root-level access even means potentially installing modified (cracked) versions of the consoles later firmware revisions, as it is possible to do with the Switch and was popular on the PS3.
