Businesses are too busy patching to worry about firmware attacks, according to a Microsoft-commissioned study.