I may be wrong but I think battery protection does not rely on firmware, it may even be analog. There are ICs dedicated to this task, that are cheap and effective.

A malicious firmware update can increase battery wear, but it is unlikely to cause a fire.