I have been reading about TPM for months and one thing seems to be odd. I noticed that TPM firmware can be updated in certain brands. Like "Lenovo" or this link which links a bunch of brands. Now from what I have read TPM is supposed to be hardcoded and on-chip, but when it has firmware updates like that, it partially makes me suspicious about the security that is advertised it would provide.
I know that TPM being updatable sometimes can help with fixing problems for customers like if there is a vulnerability, but that also means that malicious actors can also tamper with the device hardware and the TPM chip. Now they only need to "update" the TPM firmware and the hardware firmware for the attack to work.
Does TPM being updatable increase the attack surface?