I was reading a few articles online about how some firmware can be altered into malware and essentially infect a hardware equipment for its entire life time. Like almost all SSDs in the industry specially the ones intended for desktop use mostly just update their firmware while the OS is running.
Now, I am wondering, the job of a firmware, very broadly speaking, is that it gets requests from the OS and according to how it introduces itself to the kernel, like as a DVD drive, gets some commands from the OS and executes them, and probably returns some data back to the OS, or performs an operation like ejecting the DVD tray. Now if this firmware is somehow hacked or infected and if you take it to another PC, is it possible for this firmware to infect other hardware on this new PC? What if this new PC has UEFI+TPM? Can TPM+UEFI combination at all prevent firmware alteration?
Also regarding 2021 standards how much is such an attack scenario possible?
I don't know something inside me tells me this is perhaps the most stupid question and simplistic view on how kernel interacts with firmware, but I didn't know where else to ask this question. I would be thankful if you could at least give me a few links so that I can understand this form of hardware/kernel security.