I am absurdly aware of this. I am also absurdly aware that most free software isn't audited, either, and is full of unintentional security vulnerabilities more exploitable than anything going on with my proprietary firmware. Nonetheless, I believe in incremental improvements.

(Note that untrustworthy drive firmware has an easy workaround at least in theory - just do full-disk authenticated encryption, and then the drive can't do anything worse than DoS you, which is sort of a thing drives tend to do on their own anyway.)

You don't need to verify everything yourself, when the code is open you can trust one or more third party auditing

How did that work out for the HeartBleed bug that was in Open source code for a year?

and since when were device firmwares "open" or audited by a "trustworthy" and "competitive" party?

I work on OneCore (Windows) and sometimes I have trouble believing the kind of crap some hardware vendors ship as firmware.