Some of the paranoia around ME is the possibility of undocumented commands or magic byte sequences in software or via network interface that give an attacker in

Some of the paranoia around ME is the possibility of undocumented commands or magic byte sequences in software or via network interface that give an attacker invisible control of the ME without the user enabling AMT. The NIC is probably still powered and active for WoL. It's also conceivable that a state-level adversary could have hidden arbitrary DMA instructions in a NIC firmware, that only activate with a signed request embedded in a random packet. Some of the largest firmware blobs on Linux systems are for NICs. Most people aren't facing state-level targeted attacks, but without open firmware, it's nearly impossible to know for sure if one is vulnerable. And, with botnets and worms, it only takes one non-state-level attacker discovering the backdoor for everyone to be affected.