for example, when the bios asks for MBR, the firmware can inject itself in first. If the code can be executed before MBR, it is very hard to detect and get rid of.
Once in the memory, the code doesn't have to do anything unless it is waked by a signal from the network. The possibility is infinite.