Yeah, it's a fair point that e.g. broadcom firmware is a good target (https://www.cvedetails.com/vendor/5420/Broadcom.html) because it's widely deployed.