A Linux driver that supports firmware upload doesn't need to contain the firmware itself. For most modern drivers, the kernel asks user space to provide the firmware image and the driver then uploads it to the device.
During the upload process, the firmware looks like data: it just sends whatever data was passed by userspace to the card. When the device is operational though, you have two cooperating programs: the driver on the main CPU and the firmware on the device CPU.
My contention is that there is no distinction between the cases where the firmware is uploaded or comes on ROM/flash: if the two cooperating programs are considered a single work then the GPL would cover the firmware. If they are separate, then the GPL does not extend to the firmware. So the ability to create a GPL'd driver for the hardware shouldn't depend on the method used to load the firmware.
You bring up the problem of how to get the firmware if the company producing the hardware goes bankrupt. The firmware is still distributed with the device: just on a CD rather than a ROM. In such a case, it is just a matter of extracting the firmware from the CD (perhaps extracting it from a Windows driver). This is what people already have to do in cases where the manufacturer hasn't provided permission to redistribute the firmware. If they have provided permission to redistribute the firmware, then your distro probably already includes it.