For every reported, exploitable bug in a firmware blob there are generally several in machine-independent core OS components. So, upgrading everything they easily can still has value -- and that's a lot.