Actually, unlike on Windows, fwupd itself contains the code to flash firmware on various types of devices, and all the manufacturer provides is the firmware file itself.

On Windows you can (apparently) provide an arbitrary installer yourself instead. That said, theoretically a UEFI upgrade could mess with your system since that firmware ends up running on the main CPU itself.

It is also conceivable that you could have rogue firmware on some other device that can mess with the system via DMA (direct memory access). But then we are talking full on hacking, and likely unreliable across different kernel versions etc. Notably monitors don’t have such access. Enabling the IOMMU should also help protect against this (since that restricts what RAM addresses each peripheral can access).

Well, they included some MPL 2.0 repos of mine at least, but skipped others that use GPL3. Yet another that is a mirror of some otherwise lost firmware files for early 2000s wifi cards (and definitely isn’t free software) is also included.

So possibly they filter out GPL2/3 specifically, rather than only include known permissive licenses. Which is a pretty bad way of doing it.