Exactly right; the CPU is a black box.

There's nothing stopping a PSP/IME from waking up on a magic packet, executing code that doesn't exists in flash (say, it is cleverly crafted into what looks like dummy transistors used to ensure an equal metallization layer), downloading new firmware from a C&C server, and re-flashing itself.

If you want to actually own the hardware, you'd probably need a custom chip layout all done by hand on a planar node so it was easily verifiable by a third party with relatively inexpensive tools; things like dopant-level attacks assume access to the machine physically as far as I know.

If you assume that a fab could be hostile, you'd have to zero the foundry attack surface.

This hypothetical chip would be dog slow and uncompetitive, but by god, it'd be yours.