Yes, and that was supposed to be protected by CSME and ACM, but because those can be circumvented, so can microcode upgrades. Normally a microcode update would

Yes, and that was supposed to be protected by CSME and ACM, but because those can be circumvented, so can microcode upgrades. Normally a microcode update would be verified as well, but since it has been hacked in the past and CSME verification can now be bypassed it would probably be a matter of time. It used to be the case that an internal ROM with a unique on-time programmable entry that can only be read internally was safe enough, but with decapping, gliching and breaking PKI chains that is getting weaker and weaker.