Comment by kimixa

I mean technically there's nothing they can do that SMM couldn't - introduced in a revision of the 386. It's code running with system permissions invisible to the "parent" user code and OS.

You're already pretty much trusting the same people then as now, at least if they are "actively malicious".