Leaving aside the risk these genuine firmware updates possibly messing up a device & having to access via the seed phrase what's the bigger security risk?
I do not see a bigger security risk with updating the firmware. Some of the times they contain major security fixes to better protect the bitcoins you have there. You can use an additional passphrase for additional security.
How do i know a pop up on my screen is a genuine update? and who says its not a hacker pretending to provide a genuine update 2.7.0 say it was a hacker could they take my coins from me entering the password ?
I mostly ignore popups and do it directly after a bit of time has passed. How the pop up appears also counts, do not be in a haste to take any action.