Firmware is not OS.

Your machine is a distributed system. The firmware is what runs a specific node.

Yes they usually have DMA, shared busses, etc. That's an implementation detail.

An implementation detail where TLAs could theoretically get root remotely? Seems like a bit more than a detail to be glossed over.

Free firmware can have a security issue and root your device.

A working IOMMU will stop both free- and non-feee firmware from rooting your device.

These concepts are orthogonal.

Show me any device on earth that can run a browser that has no proprietary code whatsoever (including hardware) on it?

AFAIK older Talos Secure Workstation with Power CPUs was it. Everything open including CPU firmware.

Not sure about smartphones though - they mostly struggle with a fact there are no truly open source baseband.

There is no smartphone fully powered by open firmware. Also keep in mind that the hardware itself is proprietary too.