1. It needs a communication channel. My guard denies it that.

2. It will create or receive packets using standard format that existing channels support. Using obfuscated formats before traffic hits the guard means its packets will just be dropped.

3. It can still be programmed to just attack the system somehow. Now, we're in realm of targeted, sophisticated attacks more likely to be noticed. That's already an improvement to status quo.

I still think someone should try paying either company's semi-custom division to make one without a ME. Add an extra must-have feature that accelerates common workloads, esp web cache or database, to generate further sales. If they refuse to remove it, then that would be really admitying something if they accepted other modifications for money.