The threat model I'm thinking of is the untrusted 3rd party fab. For example, you want to use the fancy new process node that's only available from SketchySemi

The threat model I'm thinking of is the untrusted 3rd party fab. For example, you want to use the fancy new process node that's only available from SketchySemi in some other country. They're happy to do business with you, but you're worried about hardware trojans. Chiplets help isolate the untrusted component so you can focus your scrutiny on its i/o. SketchySemi could put antennas inside the chiplet they sell to you, but you have freedom to orient the chiplet however you want, wrap it in shielding, throttle its power, etc.