“Anyway, a potential attacker that would be set up in a man-in-the-middle position during a firmware update would be able to unpack that firmware, make modifications, add their own password hash, or turn on SSH, etc., and then, repackage that firmware and then make sure that it got down to you.”

Transcript evidence from Chase Schultz -- AppSec and Hardware.