Kernels like linux-libre
(standard in Debian and other free Linux distributions) ship no binary firmware packages by default.
From my limited understanding of their functionality, a binary firmware package, or "blob", is loaded onto the respective device and run on it, so it should not be executed on the host system.
Considering the packages are part of the root-system, is there a conceivable possibility that contents of the binary firmware could be directly run on the system with high privileges?
The concern being that binary firmware packages are not publically verifiable and usually automatically updated through software repositories to support newer devices, so they could potentially ship backdoors, keyloggers, a network tunnel or other malicious functionality at any point, if applicable.