The threat depends on who your adversary is and the way the firmware is protected.
Case A: Signed Firmware:
Some people have more resources for example if the threat is from government based malware (who may be able to coerce the manufacturer to hand over signing keys) then it's a more serious threat then if you are concerned about some random malware developer. The threat still exists but on a smaller scale.
Case B: Write Protect Screw:
Some motherboards have a "write-protect" screw that you must remove before the firmware can be adjusted. While this doesn't provide the same type of security it does ensure that you can't be attacked except during a timeframe you know about. That being said you'll have to know Thow to inspect your motherboard for a removed write-protect screw.
On the subject of mitigating an attack:
I would take the advice in the comments and require that all future updates are signed. For past attacks though your best case would be to manually flash a new safe copy of the firmware through another device. (It'd be a nice hands on activity however I'm not able to provide assistance nor instructions on this type of activity as I do not have the experience to do so).
Severity of the threat:
The threat is difficult to remove however it's a very targeted attack and since there are so many different types of computers the attacks have to be extreamly targeted and are out of reach for most malware developers. If a large group got together with a lot of funds they might be able to mass target multiple computer users but it'd be an extreamly expensive attack to pull off and it wouldn't make enough of a payout to justify the initial cost of doing so. It's easier and by far cheaper to mass target a specific vuln and keep attack new users.
Please leave a comment on my answer if you have any questions about my answer and/or need further clarification on anything :)
