On a 5-year old MBAir:

    # modprobe mei_me
    # modprobe mei_txe
    # modprobe mei

    # lsmod | grep mei
    mei_me                 36864  0
    mei_txe                20480  0
    mei                    86016  2 mei_me,mei_txe

    # python2  ./intel_sa00086.py 
    INTEL-SA-00086 Detection Tool
    Copyright(C) 2017, Intel Corporation, All rights reserved
    
    Application Version: 1.0.0.128
    Scan date: 2017-11-23 20:37:48 GMT
    
    *** Host Computer Information ***
    Name: mbair
    Manufacturer: Apple Inc.
    Model: MacBookAir5,2
    Processor Name: Intel(R) Core(TM) i5-3427U CPU @ 1.80GHz
    
    *** Intel(R) ME Information ***
    Engine: Intel(R) Management Engine
    Version: 8.0.4.1441
    SVN: 0
    
    *** Risk Assessment ***
    Based on the analysis performed by this tool: This system is not vulnerable.
    

"This system is not vulnerable". Meh - one can never be sure with ME running silently in the background...

When the HW dies, I'll most probably go for a Chromebook with Coreboot - and install Debian on it. I've had it - enough with this idiocy from Intel and AMD ; if they can't see how these "signed black boxes" are harming them, they deserve what's coming (open, and powerful enough architectures - i.MX8, RISC-V, etc).