Since you copy pasta your response, I will link to my other comment and do a bit of copy pasta here:

https://news.ycombinator.com/item?id=47953726

It is exactly how it works. Read the actual code for yourself: https://source.puri.sm/Librem5/librem5-fw-jail/-/blob/pureos...

If you can't read code, here is the marketing material: https://puri.sm/posts/shipping-new-sparklan-wifi-cards-with-...

If you don't know that the firmware for components/peripherals can either be uploaded to them by Linux or just stored on some flash chip on the component, read: https://www.chromium.org/chromium-os/developer-library/refer...