As far as I've read, it's more targeted at corporate deployments when the owner/administrator and user aren't the same person or authority. It allows things like remotely reimaging the machine if the OS install gets screwed up, deleting encryption keys if the machine is stolen or otherwise compromised, verifying that the mandatory "endpoint protection suite" is actually running, etc..
But also secure boot and full disk encryption and SGX.
You don’t need intel ME for full disk encryption? Or is that a Windows only requirement I’m unaware of?
I think some laptops don't have a hardware TPM and use software running on ME instead.
Then we should be able to turn it off.
You can remotely wake-on-wlan (maybe even 4/5g modem) - remote control, install Os, software - it's a management engine. And it's quite terrifying in its power. But sure, it's potentially useful - it's just a shame it's closed, so it's more of a liability/flaw than a feature.