the actual firmware is far smaller than that (see my explanation about how we pad it out above) - essentially the way you verify it is by compiling the (open) source and getting the same binary image

(and then of course one verifies the source by inspection)