Do you mean that the firmware can be replaced after the device was assembled? If so, what is the procedure to do that?
The official procedure is rather nicely shown here: http://doc.satoshilabs.com/trezor-user/updatingfirmware.html
your "Or whaterver?" seems to be the best summary of the thrust and quality of your arguments thus far.
When validating a system one MUST be paranoid. If there is a way to break it, no matter how "unlikely", that is the way that criminals will aim for. You cannot expect tham to be nice and only try those attacks that you have protected against.
There is nothing paranoid about fake or compromised Trezors being used to steal passwords and PINs.
The fact that one can upload new firmware does increase the risks. For one thing, a hacker or a rogue satoshilabs employee could get his malicious firmware signed, and then use it in many ways (besides the one I described). I hope that you are paranoid enough to imagine some more.
Suppose that one day a client tries to use his Trezor, where he put all his BTC, and it shows "warning, firmware is unsigned,do you want to continue?" What is the probability that he will click "yes" (and then enter his passphrase when the device asks for it), rather than calling the Trezor hotline?