Like battery, HDD/SDD, display, ethernet, wifi and bluetooth modules, keyboard, touchpad, webcam, SD card reader, BIOS/SMM, TPM, etc.

Some of those might be innocuous and unable to host anything malicious, some might seem so but have non-obvious ways to compromise the system. And some, like anything communication related... sky is the limit.

What's common with those is that they are very hard, nearing impossible to audit and analyze. When was the last time you checked whether your laptop's WiFi firmware isn't doing something nasty? Or your SSD FW?

I think we need to be worried about a lot more than just BIOS and OS.

I think the idea is to provide a feature for persistent spyware. For example if a company wanted to be able to track their laptops even if someone factory resets it.