Have a device here and I did ask the manufacturer how they would update the device, the answer is that they dont have anything to do with it, it was running CSA standard firmware.
Is matter so standardised that it have common firmware for devices?
The device is a Mill heater so its a thermostat and I’m hoping for support for energy monitoring an a few other things.
The CSA provides a feature for vendors to publish firmwares.
Some vendors use it and some don’t.
HA use only the CSA list to provide updates, AFAIK.
I was curious and found the following…
If your device is one of these, it says you need their App just to upgrade firmware to make it run Matter
If your device is already running Matter, then my guess is you will also need their app to do an update as most (but not all) vendors have yet to start using CSA for OTA, but as Wally pointed out their is a CSA website showing which vendors have firmware that HA should be able to provide OTA.
The link I gave list all the updates available on the CSA DCL.
I have Onvis S4 plugs and they only have the first 3.19 version available, which is highly recommended to be updated, but the newer firmwares require an Apple Matter server.
Eve Energy have newer updates available on CSA DCL.
It is this heater I have, bought it as it has Matter support, the conversion to Matter was flawless and so fare it works great. But I asked support how they did upgrades and the answer was that it run a default firmware maintained by CSA so Mill did not have anything to do with it after the converson to Matter. I have not digged so deep in to Matter but I found the answer a bit strange.
Its is missing any power readings but that i suppose will be fixed in a newer version of Matter.
No. The firmware is usally locked (not user replaceable - no right to repair) and you totally depend on the good will of the manufacturer to ship an update (they don’t need too - matter standard does not enforce anything) 
Just one question: Is the energy monitoring present in the manufacture app? 
People think if you by a matter device it got all metrics broken out - but that is not part of the CSA agreement and goes against “walled gardens” (or golden cages) that vendors (try to) establish. 
Again, the matter standard does support power readings - but if you Mill heater manufacture doesn’t want to spend time (and money) on it you will never get this readings into HA… 
Matter is really the successor of zigbee - continuing where it’s left, allowing manufacture to build walled gardens and don’t give the user (owner in the pastt) real ownership or even a right to repair. 
The app has power reading so its probably in HW, its constant heating so you cant use on off as a crude way to measure power usage.
One thing I dont understand is the code to connect, have light bulbs here where the matter code is on the box they came with, on this Mill heater I got it in the mail.
What do you do if its lost? Does the device have any mechanism to pair without it? I admit I could have read the documentation for Matter for a answer 
It is for sure. And it would be also supported by matter. Your manufacture claims “cutting-edge technology” but fails to implement matter 1.3 which was released over half a year ago?
Your device might just become landfill
you will receive a copy of the Matter QR code and Pin code on the email you have registered in the Mill app. You will need this to connect to Matter-compatible devices.
Source: https://millnorway.com/news-the-worlds-first-panel-heater-with-matter/
Well, what is the argument for using only a QR code for pairing? It dont make any sense over a discovery mechanism or a standardised bluetooth protocoll for communication. Anybody who know the reason for this method?
It should with Matter v1.4
It’s a way to share a secret 
Manufactures marketing department might say for security reasons… 
Sure? Not in v1.3 I linked just two posts earlier? 
New Support for Water and Energy Management Devices
- Energy Management — To help users understand and manage their energy use, save money, and reduce their carbon footprint, Matter 1.3 introduces new energy reporting capabilities. This enables any device type to include the ability to report actual and estimated measurements, including instantaneous power, voltage, current, and others, in real-time, as well as its energy consumption or generation over time.
Yes, Matter 1.3 spec section 2.12 is the Energy Cluster and 2.13 is the Power Cluster
It is not only a QR code, there is also a 11 digit setup code (typically grouped 4-3-4). The two are equivalent though: They contain a shared secret (shared with the device in question) as well as a discriminator, which essentially allows the commissioner to talk to the right device (in case multiple are in commissioning mode).
Your case (converting an existing device to a Matter device through firmware update) is especially in the future not the usual case. An off the shelf Matter device must have the QR code or/and setup code on the device itself. A lot of manufacturer laser them onto the device, but some use stickers. But in any case, with that it is rather unlikely that you’ll loose the setup code.
As @orange-assistant assistant says, this is for security reasons, it allows to establish an authenticated communication channel with the device from the start (in Matter speak the pin is used for PASE - Passcode-Authenticated Session Established). But this is not really driven by marketing, marking would rather prefer the device just jumps on any network floating around without authentication .
Typically, for this first PASE Bluetooth LE is used, but the unauthenticated variant. You can argue why not use Bluetooth pairing first, and then use that pre-authenticated channel to onboard the Matter device. From what I understand the main reason is so the same QR code/setup code can be used for multiple onboarding mechanism, e.g. there are Matter devices which do not have Bluetooth, but are already on the network (e.g. a Ethernet connected TV or similar). Such a device would likely just show a QR code/setup code on its display, and the commissioner would then find the device using mDNS and establish the connection through IP.