They did publish the source: https://github.com/amd/AMD-ASPFW
This was the PR(!): https://ir.amd.com/news-events/press-releases/detail/1154/am...
I wonder if the reported exploits forced them to publish the source.
[ my public key: https://keybase.io/rajesh; my proof: https://keybase.io/rajesh/sigs/zR5v4VI5tNh7FLIUDlY6oOZF_2qT3-SEsYw8JQZ-dOk ]