So, the next target for malware creators would be to attack the software that communicates a "lid closed" event to the T2 chip.
Based on their "hardware only" wording for the newer devices, I'm inclined to believe this is the case.
https://www.usenix.org/system/files/conference/woot17/woot17...