Legitimate hardware updates (option b) are NOT a way that malicious code spreads.
How to explain
However, legitimate software updates (option a) can inadvertently distribute malicious code if the update process or software repository is compromised. Malicious actors might exploit vulnerabilities within software update mechanisms to implant or spread malicious code.
Conversely, legitimate hardware updates involve modifications to hardware components such as firmware or physical device changes. While hardware modifications could potentially introduce vulnerabilities, they typically don't directly facilitate the spread of malicious code as compared to compromised software update channels, which are a common vector for malware distribution.