How do you make sure that the firmware image deployed on those machines wasn't compromised from the beginning? What happens when a bug occured and machines nee

How do you make sure that the firmware image deployed on those machines wasn't compromised from the beginning? What happens when a bug occured and machines need to be updated? Do you bring all machines in for maintenance or does a local IT shop do it? Maybe the manufacturer send a person but can the person be trusted to update multiple machines all over the country?