If you control the firmware already, you don't even need over-provisioning. You basically have a higher access-level. A disk is rarely 100% full so you could easily squeeze a few megabytes on a non-overprovisioned disk. Depending on how powerful the controller is, you can hide your malware inside it, you can compress some part of the disk to make space for yourself, ...

On a malicious firmware, you can make it so the host won't see the content unless it is queried "properly". Or the controller can return malicious content when queried.