It's still a security risk – code is running in the ME that can be exploited locally. Without vPro or with remote management and the network stack turned off t

It's still a security risk – code is running in the ME that can be exploited locally. Without vPro or with remote management and the network stack turned off there's a much smaller (probably close to zero) remote attack surface. With a vPro-capable chipset that has remote management enabled, the ME has its own IP address, plenty of potentially unsafe services, an insecure-by-default provisioning mechanism and much more.