this article is probably worth reading.

https://puri.sm/posts/librem5-solving-the-first-fsf-ryf-hurd...

Purism can't guarantee someone won't try to flash that firmware. so the best solution they came up with was to create a parallel chip to store the firmware they have vetted to be safe and to overwrite the modem or wifi firmware with their version of the binaries anytime a change to the other firmware is pushed through