Firmware is code. It executes on the CPU on behalf of some hardware device; or it executes on the device directly.
In general, if your own hardware is intent on spying on you, then you lose. A more worrying development is that many pieces of hardware (e.g. keyboards) contain a completely honest firmware that is upgradeable, and some malware has been spotted in the wild which replaces some firmwares (using the "upgradeable" feature) with malicious code.
The biggest firmware of all is called the BIOS; it is the code which runs first when the computer boots up, before the operating system is loaded (and, indeed, the BIOS is responsible for loading the OS). Malware installed in the BIOS itself resists, by definition, complete reformat-and-reinstall of the operating system. The CIH virus, better known as "Chernobyl virus", was already muddling with the BIOS back in 1998 (but it was doing so rather inexpertly, resulting in a mangled BIOS, not a stealthily infected BIOS). More recent virus will install in a non-destructive way, and persist.
The BIOS is not the only piece of reflashable firmware in a computer, so the possibilities are large.
To write a firmware-installable virus, you need to do some reverse-engineering on the hardware and firmware format. It seems that attackers do that. Open-source firmwares would technically make such reverse-engineering easier, but would also help the "defenders" who look for security vulnerabilities that they can fix. It is the classical Open-source / closed-source security debate which has been ongoing for quite some time and has not reached any sort of definitive conclusion yet.
The call for "declarative-only firmware" is a bit misguided, though. The idea is that no piece of hardware should come with specific code to be executed on the CPU; instead, such code should be in the operating system driver. This fails to take into account the whole situation, in two main ways:
A machine must be able to boot up in order to actually load the OS and the drivers, so there must still be some firmware somewhere (namely, the BIOS) who knows how to access the hard disk.
Many peripheral devices have their own CPU. This includes of course GPU, but all network interfaces, keyboards... and, for them, it makes no real sense to call for a "declarative-only firmware" since the code is meant for the device CPU anyway, not for the main CPU, and the OS never sees it. A keylogger inserted into the firmware for an Apple keyboard has been demonstrated.
Work only with hardware from "trustworthy sources" with strict internal security procedures (in particular background checks on employees) so that chances are that the firmware is initially clean and honest.
Make it so that firmware is not reflashable. There again, this depends on the hardware. For instance, for some motherboards, the BIOS cannot be reflashed unless a specific jumper is physically set; otherwise, the needed reflashing current simply cannot reach the chip.
Since a lot of existing hardware with reflashable firmware cannot be made non-reflashable, and "trustworthy sources" are a rarity from the point of view of any nation (because parts come from different countries), it follows that these generic workarounds are not actually practical.
(Maybe China could come up with a "100% Chinese computer" but having all parts produced on your national territory is not the same as being able to trust in their honesty and reliability.)