If I were buying into marketing I would not even have asked the question above in hopes of getting a hard reference to these kinds of details.
† e.g the following tidbits:
> The SEP is designed to be mutually isolated from the main CPU (AP); neither can compromise the other.
> No runtime blobs are designed to have total system access (no ME, no PSP, no TrustZone, nothing of that sort). Almost all blobs are running behind IOMMUs or similar firewalls, with the sole exception of the GPU firmware*. All code running on the main CPUs is under the control of the OS.
> *it's worth pointing out that this firmware is not particularly large, is shipped in plain text and even with some symbols, does not have any functionality to talk via questionable interfaces (network, etc.), and is optional and not running when the OS boots (the OS must explicitly start it)
> From a security perspective, these machines may possibly qualify as the most secure general purpose computers available to the public which support third-party OSes, in terms of resistance to attack by non-owners. This is, of course, predicated on some level of trust in Apple, but some level of trust in the manufacturer is required for any system (there is no way to prove the non-existence of hardware backdoors on any machine, so this is not as much of a sticking point as it might initially seem).
Which is an entirely different league than, say, Intel ME which completely owns the machine.
https://github.com/AsahiLinux/docs/wiki/Introduction-to-Appl...
https://github.com/AsahiLinux/docs/wiki/Apple-Platform-Secur...
My memory may be failing me or confusing things so please correct me, but I seem to recall reading somewhere that the baseband lives segregated (with only a narrow communication cannel, kinda as if it were a remote machine) from the remainder of the hardware, so while it could be made to run stuff itself it has no way to physically access to main cpu, ram, mic, nor cams (barring, of course, any vulnerability on the comm channel that would land an exploit in the main OS+hardware).
GPS is another matter, but then again it's baseband so it gotta communicates with towers, so that's a done deal already that does not even require baseband access.