I suppose "update AMT password defaults" is good, non-obvious advice to spread. But it does feel a bit rich to describe physical access and a default password

I suppose "update AMT password defaults" is good, non-obvious advice to spread. But it does feel a bit rich to describe physical access and a default password as the stuff of a security professional's "worst nightmares". "Physical access means control" has been a standard assumption for years, and this really just constitutes a failure to secure all login channels. It's a particularly silly description when Spectre and Meltdown are busy being actual "worst nightmares" threats.