I think you are absolutely correct with your assessment. I recall Alan Cox (welsh bloke, big beard, Linux kernel hacker (well: simply hacker in general will do

I think you are absolutely correct with your assessment. I recall Alan Cox (welsh bloke, big beard, Linux kernel hacker (well: simply hacker in general will do)) posting on G+ about someone booting enough Linux on a hard disc to get a prompt. No not the disc itself, off the firmware on the controller. You may also like to consider that nearly all modern server systems have an iLO/iDRAC or whatever that can do all sorts of things, and at least one internal USB interface. PCs can have the Intel ME and other horrors. The best you can hope for is that it is only your local intel. agency that potentially have routine access to your system.