In the case of some Android devices I've looked at, what you described is how they work too. The problem is that the firmware path is on a partition that's norm

In the case of some Android devices I've looked at, what you described is how they work too. The problem is that the firmware path is on a partition that's normally not writable except by signed updates. I think they'd have to be signed by e.g., Samsung, rather than Google or Broadcom, but Google probably has a key on the approved list in some devices. Savvy users with root can probably patch it themselves, if they can find the correct fixed firmware binary and know where it's stored on their device.