For a $200 billion company, refusing to spend some ressources to patch all generations is irresponsible.
Think of how many governments still use <2012 CPUs.
We used to be answer with tin foil hat jokes about jokes on mass surveillance. Then came PRISM and nobody is laughing now.
Maybe it's going to be the same with this. We will learn many years later it was enforced by some state or economical entity that benefit greatly to have a standard unpatchable backdoor on most laptop and servers on the planet.
Out of band management is fine, but have it completely disabled by default, have it run on co-processor optimized for security, not speed, in language optimized for security, not speed and when it's on have it filter all packets that aren't signed to unique secret key. Basic stuff.