Here is a question that has been hanging over me for a while, and with the release of Augmentation its come to the forefront again.
Essentially, hacking of (hacking by?) implanted cyberware.

RAW gives us the basics, that cyberware has a Device Rating (DR) according to grade:
(Note: I think we can assume however that most cyberware only has a signal rating of "0" regardless of DR)
Standard 3
Alpha 4
Beta 5
Delta 6

All fine, so far as it goes.
Here is the question, can you upgrade the non-physical elements of the cyberware - specifically the Firewall?
Can you have, for example, Standard cyberware (DR 3) but upgrade its Firewall to 5?

Related question - just exactly what can you actually run (program-wise) on cyberware?
Given these implants do have a DR (and thus, by definition, System and Response), what can be run on them?
All programs (eg. Analyse, Stealth, Exploit, and even IC/Agents) ?
Limited set of Programs ? (if so, which)
No programs ?
I am quite curious, because if any/all programs are fair-game for running on cyberware you can have the following instance:
Implanted Betaware (hot)SIM Module
Whereupon why bother with a commlink for a hacker? If any / all programs can be run on cyberware, then the Sim Module itself is working as a Rating 5 (arguably save for Signal) commlink for running your programs on (chain it through a transmitter/receiver for better Signal) and why bother with commlink vulnerability for a hacker ?
It seems that if all programs can run on any implanted cyberware, that commlinks (for hacking) are superfluous.

Have there been any rulings or even a consensus on this?

For me, my preferences are currently:
Firewall can be upgraded (Software upgrade involved, not hardware)
Cyberware has an inherent Analyse according to its innate DR.
Cyberware cannot otherwise be used to run programs off (aka - get a commlink).

There are two camps on this.

The first camp believes that anything with a device rating is effectively a commlink, and can do anything a commlink can. They'd say you could upgrade it any way you want.

The second camp believes that devices are not commlinks, and the ratings are virtual benchmarks. By this logic, you can't do anything to it. IT doesn't really have a firewall, you see, it just uses it's rating when a firewall test is called for.

Neither interpretation is particuarly wrong, although the first kinda makes standard commlinks a little pointless, as you note.

My personal assessment is that a device is it's own node. You can upgrade all it's goodies and run programs on it as well, but it has NO persona. It's a place you can visit, but you can't go surfing with it. It's just not equipped for that (aka get a commlink). I also think that any agent currently running on it's hardware cannot leave the node. Again, the 'ware just doesn't have the necessary equipment to project it's programs into the rest of the matrix like that.

So load up your cyber and upgrade it's stats to protect it from hackers. But you can't use it as a commlink.