Malware on the firmware level can potentially mess with data on the storage device. There is no point in doing that for encrypted data except maybe corruption. But what about a smartphone or other device with dm-verity where the system partition is not encrypted. Could this kind of malware break dm-verity?
Absolutely. dm-verity operates at a higher level than firmware, so as long as the malware does not show its true colors, dm-verity will do nothing.
Such a malware could only operate (apart from destroying the data on its storage) by supplying different data than it is stored. For example, upon activation, malicious code would be "read" from the disk where intact code is actually stored. That operation would be caught by dm-verity:
From the docs:
dm-verity protection lives in the kernel. So if rooting software compromises the system before the kernel comes up, it will retain that access. To mitigate this risk, most manufacturers verify the kernel using a key burned into the device. That key is not changeable once the device leaves the factory.
The firmware hack does compromise the system "before the kernel comes up", but then it would hit against the read-only key check. So the hack would need to also disable the verity code (which may or may not be possible depending on where exactly this code resides).
On the other hand, how exactly is the key recovered? The kernel has to ask the device for the key, and while an external program cannot change the key, the hacked firmware can ignore this fact and report a different, changeable (and changed!) key.