Probably, if you hacked a device to a point you have root access or worse it's not that uncommon that you are able to reflash firmware to custom firmware.
A lot of firmware, and firmware signature validation, is ... not very well done.
Practically it's often not worth it (you already had root+ access. It's doable, but not simple and less uniform applicable.).
But there have been known cases of viruses tryign to persist themself in the firmware of connected devices (which in this context includes all internal devices including the motherboard).