Is that possible to put a virus into another hardware rather than BIOS? Why do the controller and engine write to BIOS?

<a href="mailto:flashrom%40flashrom.org?Subject=Re%3A%20%5Bflashrom%5D%20Why%20does%20the%20flash%20content%20differ&amp;In-Reply-To=%3CMWHPR02MB2463DFBA2A682AD6C00B3E25D45A0%40MWHPR02MB2463.namprd02.prod.outlook.com%3E" title="[flashrom] Why does the flash content differ">wangziheng at outlook.com
       </a>