For a vendor-supported array, the vendor will notify you of any firmwares that are considered "required" or critical, and there will typically be a seamless online method of updating the firmware.
For server drives, again the vendor will typically allow you to sign up for notifications (you specify the models of hardware you have, and it tailors the notifications to those models only). You will usually have "critical", "recommended", and "optional", or similar. Generally speaking, vendors are pretty conservative, so a critical firmware I would more or less consider essential (you evaluate each one, obviously). The pain is that for servers, a drive firmware upgrade requires a reboot.
In cases like that, I will contact the vendor, and ask them to confirm the danger of not upgrading.