That 6 day takedown is actually pretty fast, which makes me wonder what proof you uploaded beyond the timestamped file. Did the platform ask for your original layered file or just the flat image, because that difference seems to decide who wins these cases. I'm asking because I've heard of sites dragging it out for weeks when the thief fights back.

Are you sure it was really the firmware check killing the WAN port, and not just the failover masking something else? Daily firmware checks usually just ping the server and download if there is a new version, they don't normally drop the port for 90 seconds. What you probably saw was the LTE failover kicking in because the main line went down for another reason, and the timing matched your check by chance. Did you go back and look at the WAN logs for the actual disconnect reason, like a DHCP lease renewal or a PPPoE re-auth? Because if the real issue is still out there, it could come back later and you would never know since the failover covers it.