> I really need to be able to control which software runs on MY devices
Well if you're running an Intel powered device, there is the Intel Management Engine[0], which is a minus ring zero backdoor with unfettered access to everything. It even runs MINIX! It's not really your computer.