There are a number of ways to write protect the flash part where (CPU) firmware resides. Some permanent (or with a jumper), others until the next reboot, by whi

There are a number of ways to write protect the flash part where (CPU) firmware resides. Some permanent (or with a jumper), others until the next reboot, by which any attack vector vanishes. So checking that your libre firmware locks down the flash as soon as it's done with its work can be a pretty strong guarantee.