How safe is the firmware update mechanism?

Stupid user question maybe, but what prevents malware on a compromised machine (or a compromised chrome app) from redirecting a firmware update to a malicious version of the firmware?

Are firmware signatures hardcoded into the chip so only yours can be accepted?

(I understand that as long as no new firmware update is required, this is hypothetical as the firmware update requires a key wipe)