This is true for the latest iterations, where MINIX 3 is embedded in the Platform Controller Hub (PCH). Earlier iterations were running on ThreadX RTOS embedded in the Northbridge.
To my understanding some systems, but not all, implement wakeup-on-LAN for the ME, even, when the system is shut down but is still connected to a power source (which is true for most modern machines).
There are generally two versions of the firmware which can be used. A light version normally used for personal computers and a heavy version normally used for servers.
The light version doesn’t contain the AMT module, the heavy one does.
If you are using the firmware that includes AMT, it can be disabled.
The problem is we don’t actually know what other modules are running, who can run modules and which ones use network access.
1. https://libreboot.org/faq.html#intelme