Now that you mention it, I wonder what non-separable code would run on, say, a Corebooted Thinkpad running Linux with the Intel ME disabled. Surely that would be running 100% code that was not on it when it left the factory.
ref. https://doc.coreboot.org/northbridge/intel/haswell/mrc.bin.h...
... plus Intel's microcode.