> even if the manufacturer wanted to, they can’t provide sources

In many cases they don't even have them or may not be aware that there's an upgradable firmware in some of the components they're using at all.