Intel/AMD/Apple have put a decent amount of work into protecting boot and EC firmware but all the other stuff is probably totally insecure. Any code running in kernel mode could flash a lot of different firmware. Note that built-in devices probably have their firmware bundled into the main boot firmware so they may be protected.
Just because something is possible doesn't mean it's likely that an attacker would burn a 0-day against you though.
Just because something is possible doesn't mean it's likely that an attacker would burn a 0-day against you though.