1. Is it possible to show firmware version (and how reliable is that - obviously if you're owned all bets are off but is versioning reliable here too) I need to Google some (though if the group has looked into this...

Yes, use

platform_info

to collect the platform firmware versions, this is BIOS/UEFI/etc. This collects information from SMBIOS normally. On macOS

platform_info

uses IOKit to look for data too. On macOS you can also use

device_firmware

which performs a search of IOKit to find devices reporting firmware versions.

Thanks