[mulmen]

Yes they have to be able to update the system but in this case they are also able to update the firmware without asking which means anyone who can impersonate or coerce them can also update the firmware.

[ibotty]

If you control the OS, you also control the firmware (if you want a way to install new firmware from the OS). No way around.