The bootrom where the exploit is triggered can be patched at the factory before its distributed. It cannot really be modified after it leaves because the bootrom is read-only. The 5.X firmwares on the other hand have the software-based exploit patched (or at least parts of it). They also have code embedded in the firmware for a new SoC that doesn't have this RCM exploit to begin with but these consoles have yet to appear. Probably because it would be easier to patch current units in production than start production on a Switch with a new SoC.
