[HHad3]

You can update SEP firmware, but only by providing your PIN. This is why iOS prompts for you PIN again before updating.

This still effectively prevents Apple from adding backdoor to be installed on phones the user can no longer access.

[adastra22]

Depends on the enclave. I don't know Apple's, but the ones I worked with would wipe secure data on a firmware update.