Epson is teaching the internet not to install security updates

My favorite; common with the old HPs, not sure about the newer ones, is the firmware update implemented as a print job. They typically provided a little utility to actually ‘print’ it; but it was sent out via your ordinary connection to the printer in the same way as any other job. Cute; unless the implications of shared printers and the fact that HP didn’t do any sort of firmware verification until later start to make you nervous about just how much control PCL can be used to obtain.

With some of the really cheap USB ones there may not be much ‘disguise’ involved. A number of USB peripherals(and not just USB) don’t store much more than the intelligence required to wake up and request a firmware blob from the host; and the VID/PID required to tell it which one to provide. Not an irrational approach(cut some flash off the BoM, dispense with with any real distinction between ‘firmware update’ and ‘normal boot’, be very, very hard to brick because the teeny little preliminary stub will hopefully be small enough that you don’t have to patch it and everything else goes away as soon as power is cut); but certainly makes life more difficult if you want to avoid having your updated driver modify the device’s behavior.