> The BMC is supposed to be on a trusted network inaccessible from the outside.

After it left the factory. But can't the firmware be installed by someone while the board is in the testing phase?