BMCs can also be patched. HP updates iLO regularly. I even got a major update on my servers adding things like HTML5 consoles (previously it only had .NET and Java which is a pain in this day and age)

And this is for a server I paid $150 for after cashback from HP.