Isn't that just setting the HAP (High Assurance Platform) bit in the ME blob to disable it after bring-up? For Intel platforms it is possible for the end-user to modify the firmware themselves in many cases. https://hackaday.com/tag/hap-bit/
Maybe something like a RISC-V core written to a FPGA by yourself is pretty safe.
* https://github.com/MiSTer-devel/Main_MiSTer/wiki
Combine retro with FPGA as you like(within the constraints of that development board).
Or waste Watts by using software emulation.
Mine is as an tutor on an evening college, casual writer and some dabbling into some embedded projects. For THIS use case my (very retro) Atari 520 ST with 4 MB Ram is totally working. Is it nuts? Yup, but i can be sure that no state trojan is monitoring my totally boring behaviour.
"Why does citizen #2743652 have internet/electricity service with no registered devices or online profiles?" *Does deep background check*
But every PC has a SMC which deals with things like power-on, WOL, etc
I think some things are overblown and unjustified paranoia.
Other things? Justified paranoia.