Not only that, but TPM chips are hopelessly physically insecure because of bootstrapping issues. But firmware TPMs (fTPMs), which run in a secure enclave or ME

Not only that, but TPM chips are hopelessly physically insecure because of bootstrapping issues. But firmware TPMs (fTPMs), which run in a secure enclave or ME, do not have those issues at all. The bootstrapping issues are namely that the BMC and BIOS don't necessarily and securely know a public key for the TPM they're talking to, so generally they don't even bother encrypting sessions to the TPM, and even if they did, they'd be subject to MITM attacks as long as they don't know the TPM's public key a priori. The attacks on bootstrapping do require physical access, so it's not exactly the end of the world, but it's still not good. But again, fTPMs don't have these problems because the communications between the CPU and the fTPM are on-die, so there is no external bus that could be used for mounting an attack.