The exploit happens before any patchable software is running, it's not called ROM for nothing.