"As a service" in this context means the mental model / delivery pipeline is more like subscribing to a service than purchasing individual software. I'm sure this makes more sense to Microsoft folks; open-source folks are more likely to call it "continuous deployment" or "living at HEAD" or something. They compare it to Windows-as-a-service, the idea that you run the current version of Windows, not the version you paid for and future updates involve change control and procurement and other bureaucracy.

Firmware does change and often has security vulnerabilities, so you do need to be keeping it up to date the way you keep your OS up to date. Among other things, it includes processor microcode / errata fixes like some of the Spectre, Meltdown, etc. mitigations. It would be nice if we lived in a world where this doesn't need to change, but it does, and thankfully it is firmware and not hardware.