This has been my impression also. For example, if you have a nice “update firmware” button that automatically fetches and installs the latest proprietary firmware, then I think that could disqualify the device from getting the RYF certifiication. However, that does not mean it must necessarily be impossible to update firmware, just that the device does not specifically facilitate it.
I agree it would be good if the FSF would clarify this, how exactly they draw the line. For example, suppose there is a hardware component that has a separate physical port intended for firmware updates. Then, if it’s known/believed that only proprietary firmware exists, does that mean the physical port must be hidden or even destroyed on a device in order to get the certification? What if a FLOSS firmware version appears later, would it be okay to leave the updating possibility to allow for that?
Edit: related to the discussion here: In defense of the FSF RYF certification