

I don’t know where you got the idea that I’m arguing that old versions don’t get new vulnerabilities. I’m saying that just because a CVE exists it does not necessarily make a system immediately vulnerable, because many CVEs rely on theoretical scenarios or specific attack vectors that are not exploitable in a hardened system or that have limited impact.
Not sure about erasing all of it, but it is (or was) certainly possible to delete enough of it to brick a motherboard https://www.phoronix.com/news/UEFI-rm-root-directory