In an ideal world they'd have people whose job it is to monitor upstream activity in the components used in the firmware and maintain this. Sounds like they did not have that.