TLS/SSL Role in Browser Exploits + Does a Person Need to Hack a Computer OS in Order to Hack the Computer's Firmware?

Hello,

1. If a person has a browser exploit, can they use it against their target if the target is using SSL/TLS when browsing online, or only against HTTP traffic? Either, way, how/why or why not?

2. If a large and powerful adversary wants to remotely hack a target's computer in order to attack and infect the target's firmware, does the adversary first need to hack the target's OS, or can they just go right to hacking the firmware? (For example, is an OpenBSD OS more secure against the computer's firmware being hacked, or does the OS not matter?)

Thank you.