It's not shocking at all that they allow firmware updates through the print port. That's very typical.

What's shocking is the claim that the update isn't signed. I'm at a loss as to how to describe how terrifically awful that is. It's /so/ shocking to me, I have a hard time believing it. If true, it's astoundingly negligent on their part.