Yes they can, but as I understand it they are using TPM to screw us over, hence people celebrating its being popped. No misunderstanding of trusted computing necessary: there aren't, in practice, other vendors to choose from here.
I do see that the existence of both trusted and untrusted systems could exert some pressure on consumers to adopt the latter, due to the unavailability of certain services on the former (e.g. DRM, banking apps on rooted Android phones etc).
The danger here is a loss of "freedom to tinker", which I do appreciate very much, and I share that concern. But has that actually happened with TPM?
the TPM is a PASSIVE component. It only responds to your requests and you can do cool things with it.