The difference is that the firmware presents a tiny attack surface. You can’t social-engineer machine code, or use an unsecured access point to gain entry.