I think it will be more efficient and reduce Flash wearout if many operations will be performed in memory.
For example:
- Uploading a file to the device is most likely only temporary - so it is better to keep it in RAM.
(Writing it to permanent storage is wasteful if it will be deleted soon.)
This includes scripts or backup files etc. - Capturing traffic using the sniffer allows to save a file.
It is more efficient to save it to RAM (assuming it isn't too big) so that later the user downloads it to PC and can delete the file which is on the device. - Some commands would be more efficient if they are done in memory, due to their relatively high execution frequency.
For example, we might want to have a mechanism that if some MAC address is detected in the network, then we use the firewall to block a certain type of traffic.
Currently, that would require changing the firewall everytime that the address is detected - which would perform a write of the change to the permanent storage.