> It would make more sense to have an secure OS in ROM that runs at boot and at various times which bypasses the installed OS and drivers, and can scan firmwares, microcode on various buses and critical files.

Isn’t that what Intel ME is? The only difference being we don’t know what exactly it does?