Does this exist on Epyc platforms that don't use a traditional chipset?

This is bad, but seems like more of an incremental issue than anything. Can you audit every line of source in your system? No closed source drivers or firmware on any devices? No devices on your network with vendor controlled firmware? You log all network I/O through a passive tap? For the average user targeted by a state actor this makes little difference.