Aren't HSMs built to fail closed? Surely the designers would have added some protection mechanism that shuts down/resets the module when it encounters anomalous voltage inputs. Or is the attack surface simply too wide for that to be feasible?