I think that the saying he's after is "letting the nose of the camel into the tent". The camel's nose poking in through the tent flaps isn't a problem in and of itself, but one still discourages it because of what will inevitably follow if one does not. It's much easier to address a camel-in-the-tent problem when it's just a nose, not the whole camel. This is similar to "nip it in the bud" (which is frequently mangled into "nip it in the butt" -- the dog's approach to discouraging a postman).

Let's just call this a gross oversimplification and be done with it, shall we?

For security reasons. Your firmware OS might have exploitable privilege escalation bugs, so you don't want to run untrusted software under it directly, only in a protected virtual machine environment. That virtual machine environment must have its own OS, and that would be a disk-based OS which is easier (and safer) to update in the event that security holes are found. It's preferable if the whole boot environment is as near to possible as read-only, just to reduce the possibility of malicious exploit. It shouldn't even be possible to re-flash the system without physical intervention (such as changing a jumper).

This is true for the flash-based OS and the built-in hardware, which is why you can boot into a usable system so long as enough of the hardware is integrated on the motherboard. Don't forget plug-in cards and external peripherals, though. There's no avoiding the need for those drivers, in general.