I would say that there is no special value to firmware updates when you have no visibility into or control over the authors of the updates.

We need adversarial competitive firmware that comes from different sources the same as we have for software.

I know why we don't have that. It doesn't change the fact that that is what we need.