Do you think the keylogger running on your and my machine came in by exploiting the ME or a C buffer overflow somewhere in the OS or userspace code that sister claims you "control"?
"Luckily," we don't have to choose between being afraid of firmware and afraid of C and C++. The shitty Management Engine and other firmware code will be written in C or C++ by terrible coders. The UEFI source code is over 7000 files and 100 MB of code, according to Matthew Garret:
https://www.linux.com/learn/uefi-secure-boot-big-hassle-ques... . And it can continue running once the OS has booted now (a great "feature" that was missing from the BIOS, right?)
Intel ME is a blob written by Intel however and all OEMs uses the same one. I'd bet on UEFI code being worse than the Intel ME firmware.
Isn't this kind of like arguing over which brand of hot dog has more pink slime and factory floor sweepings? They all do.
Anyway, ME is likely to be a much higher value target for hackers. A compromise there would compromise millions of PCs, whereas a UEFI hack would be specific to one vendor.
Obviously, but UEFI tends to cause more of the practical problems and attacks, including non-security ones and DoS attacks (some of which is easy to do under Windows).