I misread that there, so disregard the first reply.

Point still stands: no one forces you to upgrade your BIOS (unless there's problems) and even then, patching the BIOS upgrade itself is still an option.

So it remains under user control.