The article you’re linking to starts with security researchers who installed their own backdoor which went undetected. Then it continues with a warning about the dangers of not being able to check if the firmware actually is a firmware actually from the vendor and not a manipulated one.

While I’m pro open source and agree that there are dangers not knowing what firmware is used I fail to see how an open source firmware / bios world be immune to be switched out.

What am I missing here?