An example that comes to mind is the recent change to NX-1300 audio chips that caused a "squeak" that was resolved with a firmware update that can't be used on earlier hardware. That one was well-documented, with serial numbers and everything. Trying to get coders to document their work is like herding cats. Hardware hackers are even more rare and more feral.

It takes significant extra work and time getting a proper tech-writer involved to translate the [Japanese-]engineer/coder-speak to human-usable language and they don't do it unless they think it's really necessary.
I do agree that we need more guidance in understanding what to do with a "security update". Is it like computer virus defs that should definitely be applied to close an important hole in, say, encryption key management, or are they closing a hole in their own license key management, and we don't necessarily need to apply it to existing hardware?