Security issues in ROM are still security issues. Even if it is in ROM, it still needs to be auditable.