One solution is to require all firmware to be signed and have the device check the signature before writing that firmware image to its memory; my current laptop has an option to enable this in its BIOS (the option is permanent - if I enable it now I can't disable it anymore, that's why I didn't enable it).
There are many drawbacks however :
induces a false sense of security, as we don't know how the manufacturer protects the private key used for signing and I don't expect them to admit their failure and send a nice "Sorry the firmware key leaked" email to each customer; also even if the key didn't leak, the NSA and other evil agencies may still have stolen it and no one would know.
making custom firmware is impossible - while I'm fine with the fact that they're for-profit companies and their firmware is closed source, I am definitely not fine that they prevent me from installing whatever I want on my own devices I paid money for, for some so-called "security" even though the NSA already stole the key from them (I remember installing a custom BIOS on my old Thinkpad because the original one had a wireless card PCI ID whitelist preventing me from changing their outdated 802.11g for a 11n model, something impossible with firmware signature checks in place).
Another, better solution is to require physical intervention (a press of a hardware button on the device itself) to allow firmware to be installed, which doesn't have the above drawbacks; the firmware authenticity check is to be done by the user and he is free to install whatever he wants. Whether the user wants to install firmware, he presses the button and the device allows one firmware install before locking itself again (or timing out after a minute if nothing was installed).
The only drawback with that option is each device would have its own hardware button, on a typical desktop computer there's the BIOS/EFI (which will often update everything else embedded on the board - NIC, "fake" RAID controller, etc), possibly the third-party video card's option ROM (also called video BIOS), third-party RAID controller or NIC, storage drives, etc.
While everything on the board could be wired to a single button, all third party hardware would have its own button, sometimes hard to press due to the hardware being inside the computer's case. This isn't too problematic as users incapable of opening a computer case usually don't update firmware anyway due to the "risk" (it's minimal but creating bootable DOS disks feels scary) and complexity.
A theoretical solution would be to require all commonly used ports (SATA, PCIe, etc) to include a dedicated "firmware flash" line that would be hard-wired to the board's main firmware flash button.