Are the updates signed? Or can anyone make a piece of software to do this?
I believe the update process for firmware is specific for the manufacturer or even model. While one would expect these updates to be cryptographically signed in this times, there is no guarantee that it actually is done properly (or even at all) nor that the signatures are validated properly nor that there is a working downgrade protection. It is too easy to make bugs in this area, as shown in Flaws in self-encrypting SSDs let attackers bypass disk encryption a few years ago.
Apart from that, even if the signature is properly done and verified this still leaves the problem that the key used for the signature might get compromised and the attacker might be able to create a new firmware. While this is less likely for "normal" criminal attackers it probably is in a range of what government agencies can do - especially government agencies from the same country as the manufacturer.
In other words: don't fully rely on the manufacturer. The risk of broken firmware or broken firmware update process can be mitigated with adding encryption and integrity checks in software outside the disk and by doing backups.