And yes, security will be seen as optional. Because security is not the product, and thus not the revenue source, of most of these companies.
I'm not pushing our solution, just sharing what I have observed. Management engine in practice will _always_ be unpatched. It is _inherently_ unsafe. Anyone who thinks they will keep their patches up to date, unless they work at Amazon or some other entity where they can institutionalize it, is crazy. I had a CIO directly tell me their mean-time-to-patch CVEs in their exposed servers was two years. The statistics on Linux bug lifetimes show that 5Y is not uncommon.
Security is our underpinning but not how we sell (for the reasons I am explaining); there is a very good reason for that which is that people don't actually buy real security, they buy tools to pass audits. You can see shadows of this in the way that companies continue to deploy vulnerable agents even when they are revealed to degrade host security, or in the resistance to internal secure communications (and the reaction in general to TLS1.3).
Security practices inside large enterprises are bizarre and the result of perverse incentives. Let me give an example. The internal use of Websense proxies, for example, will tend to block encrypted content within TLS connections using entropy detection; a malicious actor will simply use an entropy reduction strategy (bananaphone or whatever trivial solution); a legitimate user who is sending an encrypted document will have that document blocked. People justify these tools as meeting the need to allow inspection of traffic; however your Websense administrator is not actually qualified to see all of the traffic that flows over the proxy (for example, does being able to read the CEO's mail make the admin an insider?) and protocols that carry content that is both safe-to-inspect and unsafe-to-inspect (the CFO's password, for example) do not differentiate the two making inspection inherently dangerous. A decade and a half ago, I knew someone who peeked at the loading dock, invoicing and shipping so that they could predict how the quarter was going to time stock sales.
That's a comical example but it's one we have directly encountered in the secure exchange of cryptographic material; but similar issues crop up all over, from the use of transparent proxies and corporate CAs (to "allow inspection") to all manner of craziness.
The facts lead you to a world view that is even more cynical than the idea of security as theater: instead, security as _ritual_. "I need this server to be secure, I'll install some agent"; "We need this server to be inspectable; I'll disable all forward-secrecy protocols and decrypt and inspect the content." And so on.
So .. I don't think it's high volume or anything else like that which is an outcome of process rather than a choice. It's that many companies long ago adopted a world view where any kind of real security is as far from consideration as possible.
(not speaking for skyport, speaking for me)
We sell an x86 server where the management engine is unreachable; there is no path from the external network to the ME. I can tell you point blank that most enterprise customers are unaware of even hypothetical issues there or for that matter with IPMI implementations. We stopped using this as an early feature in our customer conversations because they just couldn't care less about it until they hand you off to their deeper technical team (if they even have one, which is not as often as you'd think if you have not realized that security in enterprise datacenters is almost always an afterthought). Otherwise it just doesn't come up very often.
Until high-volume customers take a concern, no amount of outrage or paranoia is going to make any difference. You might as well be outraged that, for example, implementations of some BIOSes are so poor that the measured boot (hashes to TPM) don't cover all of the configuration items or vendors fail to correctly lock down their firmware flash or update path. This is pretty common and you don't hear about it because most people can't make measured boot work and generally don't even try.
Security, in general, appears to be mostly viewed as optional. Obviously I think getting this right is important, in our case for other reasons, but in and of itself people generally view security as an expensive vitamin.