Consider:
- Power management chips (of which there are dozens) each containing programmable MCUs
- Batteries, of course, contain one or more MCUs each
- Clocks
- 'Glue' MCUs for things like DMA controllers and USB controllers. (USB controller firmware has been exploited from the port side, and it's not upgradeable)
- Supervisors
- RGB LEDs (!)
- SD cards have several (see Bunnie's work)
- Ethernet, WiFi and Bluetooth controllers contain several small and usually a few large computers each
Some of these have fully-baked ROM code, some are programmed and modifiable through flash, and some have firmware written at driver load time to save money.