If we are talking about making new laws, why not just modify the law to exclude firmware from any IP protection. i.e. compel disclosure of the firmware, and also ensure the device manufacturer is protected from any lawsuits arising out of such disclosure.