How do headphones work? Do they contain any firmware or any instruction set? Are they vulnerable to anything? Good old wired analog Jack ones, not USB wired, wireless, Bluetooth which have lot of fundamental flaws in design...
Analog audio cables do not carry any digital information. While some higher-end audio products may have firmware for equalization, sophisticated noise cancelling, or filtering, the firmware cannot be updated over the audio jack. The connections are entirely analog. They usually connect directly to each speaker's voice coil, although they sometimes pass through powered amplifiers first in the case that the driver has a resistance too high to power directly. See also Phone connector.
Do they contain any firmware
Some high-end devices do have firmware for post-processing of the analog audio. This firmware is either not meant to be updated, or can only be updated over a dedicated digital interface. The analog audio cable would not be used for updates unless the manufacturer is silly updates the firmware by encoding digital information in a frequency range supported by the computer's DAC.
or any instruction set
An instruction set is specific to CPUs (whether it's a simple 4-bit MCU or a modern, sophisticated x86 CPU). An IC that has firmware may or may not have an instruction set. This is generally irrelevant to the capabilities of an IC and its security implications, as you can still have a turing-complete circuit with no real instruction set.
"How do headphones work" is not a security question, and could be answered by doing some online research.
"Good old wired jack" headphones are entirely analog. Have you ever taken apart some cheap earbuds before? You'll see the wires connect directly to an electromagnet in each speaker.
Any vulnerabilities would be limited to physical security; e.g. tapping the cable to record what you are hearing, or cutting the cable to cause a denial of service.
If the headphones use batteries, it is not infeasible that they contain firmware but it is unlikely in most cases. It would be difficult to know what vulnerabilities could exist without specific examples of such implementations.
See this site: https://www.cnet.com/products/apple-airpods/review/
Apparently Apple's Airpods have received a software update. Which implies there is a processor, an operating system, software running on the operating system, and firmware that can be updated.
I suppose they are not the only ones, and I would expect a trend where sound quality is improved not by using better sound hardware, but more sophisticated software.
As far as vulnerabilities are concerned, these Airpods are most likely only supposed to ever receive firmware updates from Apple, so that can be made safe. And if there is a vulnerability, what could it do? Shout in your ears? There's no microphone, no ability to send any data anywhere.