Oh yes, BMCs can certainly be patched but I had the security issue long after the last patch for the motherboard was released so it really comes down to the manufacturer support level as usual. HP likely does better than Supermicro which likely does better than ASRock