> This puts them somewhere between x86 PCs and a libre-first system like the Talos II in terms of freedom to replace firmware and boot components; while a number of blobs are required in order to boot the system, none of those have the ability to take over the OS or compromise it post-boot (unlike, say, Intel ME and AMD PSP on recent systems, or the DMA-capable chips on the LPC bus running opaque blobs that exist on even old ThinkPads).

https://github.com/AsahiLinux/docs/wiki/Introduction-to-Appl... - list of firmware blobs

Pretty well outlined here: https://github.com/AsahiLinux/docs/wiki/Introduction-to-Appl...

> while a number of blobs are required in order to boot the system, none of those have the ability to take over the OS or compromise it post-boot (unlike, say, Intel ME and AMD PSP on recent systems, or the DMA-capable chips on the LPC bus running opaque blobs that exist on even old ThinkPads).

Compared to the iME, not much, since at least the secure enclave subsystem won't run any non-Apple code. The scary difference about the iME is that it is directly connected to the network.