Firmware is included for 45 devices, but no one but the vendor/manufacturer can actually provide security updates for them, so they are largely just the last release.

https://gitlab.com/divested-mobile/firmware-empty/-/blob/mas...

This is indeed an issue and is documented on multiple places of the website.

Patching everything else is the best harm-reduction for this.