content: Windows certainly seems to be in the middle here. Certainly, hard drive firmware does not flash itself, and the firmware can't directly call home. Either the drive needs to be in the attacker's hands or a presumed-Windows trojan needs to get admin access to send raw commands to the drive. This needs to happen at least twice, and the latter is usually easier. Even more so on Windows.