Yes, but very unlikely.
A bluetooth headset has a microcontroller, EEPROM with firmware, audio circuitry and bluetooth chip (which is itself a microcontroller with its own, distinct firmware implementing the bluetooth stack); I'm pretty sure there are manufacturers that combine all of these elements on a single physical chip.
If you can find a vulnerability in the microcontroller's firmware and make it execute arbitrary code, you can write to its memory and overwrite its firmware with your own malicious version.
From the point of view of a malicious attacker, that would need to either compromise the device that's currently connected to the headset in order to compromise the headset later on, or to get physical access to the headset to tamper with it (via bluetooth by forcing it to connect to an attacker-controlled device that will exploit the headset, or directly via USB if the headset has such a port and its data pins are actually connected to the microcontroller).
The big question is, what does that give you ?
There isn't enough memory on the device to record calls for later retrieval (and that retrieval would also need physical access to the device later), so that idea is toast.
There isn't an easy way of streaming call audio to a different device, it may be possible if you manage to reimplement the bluetooth stack with some custom version that allows communicating with two devices simultaneously, the phone and your other device that will receive the data; plus you'll need to be relatively close to the device to communicate with it, especially since these headsets don't have a very powerful antenna.
The only way to compromise a computer or phone would be to know a vulnerability in that computer's bluetooth stack allowing arbitrary code execution, and then make your headset exploiting that vulnerability when connecting to the computer/phone.
In my opinion, all these attacks require some kind of physical access, and if we have physical access we can pull them off way easier by compromising the targeted machines directly (malware or just hardware keyloggers/microphones/other dark side spy device) rather than wasting our time with the headset.