Amusingly, many postscript printers are even less secure.
Many years ago my friend (unnamed here) wrote a proof of concept postscript job that simply stayed resident indefinitely and did various amusing modifications to later jobs and ongoing changes to printer behavior.
The job worked unchanged across significant numbers of printer models.
No upgrade attack needed, the primary use vector was enough to compromise.