How is this enabled though? Sounds like ILO/DRAC/etc., if a bit more capable. But if it's not turned on, is it that big of a deal?

If we assume Intel is malicious, they hardly need a platform like ME to do harm. And isn't this kind of stuff only available on the more expensive systems? Because they include this to sell to enterprise help desks, right?

I dislike articles that seem set to spin something. At least explain the plausible or documented reasons, then show why it's bad.