It’s worth noting that other (non-HP) printers, copiers, and all-in-one thingamajigs are probably vulnerable to a similar attack, too.
Well anything produced to be mass/IT-managed probably provides an easy method for firmware upgrading. And all firmware encryptions/checksums/etc are of course (at least theoretically) crackable.
I don't see how this could come off as a surprise to anyone in the industry.