Hardware can be and is implemented such that it changes behavior over time too, or have undisclosed remote capabilities. There are also fun features where various fuses blow internally if you do specific things the vendor doesn't fancy.

There sure is a difference in threat model, but I don't think the person I was replying to appreciates that, which is kind of what triggered my reply.