Does firmware of a device run in the device or the device's
controller?
When does firmware of a device run? Does it run if and only if the cpu
sends commands and/or data to the device's controller?
It depends entriely on the device, and it's not either/or.
For example, your garden variety SATA disk drive has one or more processors of its own, and much of the disk drive's firmware is executed on those. Among other chores, the disk drive's processors are constantly monitoring the disk for errors, and reporting back to the host CPUs when requested. This is called Self-Monitoring, Analysis and Reporting Technology (SMART).
Devices can also have Option ROM which contain support code for the device that can be executed by the host CPUs.
For BIOS, is it firmware for the bare computer system. Does it run in
the cpu? Does it still run after the OS fully started?
Yes, it runs on the computer CPU, but I get the impression that you think it runs in some sort of separate execution context. It's really just a library of code that the OS can call as needed to perform some sort of low level IO (BIOS stands for basic input/output system). The OS may or may not ignore the BIOS if it has some alternative library of code for the same task.
Firmware is really just a type of storage. It can contain code for use by a host CPU, it can contain code for the onboard device controllers, or it can just contain data.