I have had pretty good luck running me_cleaner on various computers - the main difficulty is the hardware access to the SPI flash, but once you have that it's not too difficult, and low risk because you can always flash a backup of the original back on.

It is a bit unfortunate that all we can do is disable some modules or set the HAP bit without knowing exactly what has been neutralized, but it's certainly far better than the extremely limited control Intel provides the user over the ME.

It will be interesting to see if Intel tries to make this more difficult with future iterations (it will certainly be even more suspicious if they do).