About halfway down, the Bloomberg article mentions a BMC, a baseboard management controller. This is an existing part of mainboard design that has been around

About halfway down, the Bloomberg article mentions a BMC, a baseboard management controller. This is an existing part of mainboard design that has been around for just under a couple of decades. Read up about IPMI and BMCs, what they do and what their capabilities are. Then consider the threat, explained elsewhere on Hacker News several times, of simply supplying an extra ROM chip containing different firmware for that processor to run. Focussing on the technical is focussing on the wrong thing. Bloomberg's point was not that BMCs can do this, nor that they can be made to do this. People have discussed these on-board systems and their problematic natures rather widely. It was that the supply chain is vulnerable, and that (on the assumption that Bloomberg is right) this problem with the supply chain is no longer a hypothetical case of what an attacker government could do, but is now a documented case of what one government has done, a few years ago.