My guess is that the maker does this by intent not by whims or malpractice.
The container can only *protect* the firmware file up to the moment it is downloaded on the computer. After that, the firmware file will be retrieved from the container and starts an unprotected life on its own.
In order to prevent damaged firmware files being installed, the camera needs to be able to get a security checksum from the bare firmware file itself.
My guess is that Nikon already adds a security checksum to firmware files, heck even better maybe they also sign it with a private key in order for the camera to check for authenticity (with the public key).