Interesting question Tim! I actually raised a TAC case about getting BIOS updates and procedure on how to do this. I got the below response from TAC:
"Thank you for your patience with us. Much appreciated.
We verified with Development team and as confirm that BIOS upgrade is not possible at the moment.
You can raise RFE(Request for Enhancement) with referring below article."
In my option a vendor would release an update if they felt there was a compelling reason to do so ie. add support, fix bugs, fix vulnerabilities, and if they do indeed release an updates it would make sense that clients with support contracts should be entitled to upgrade (if they so choose) using a procedure provided by the vendor.