I'm also worried about this, which is part of the reason why the Precursor design avoids using hard IP blocks like RAM and USB controllers. It does limit the performance of the system (we have a simple async RAM interface and full-speed USB only), but the explicit priority is transparency over performance.

The main attack surfaces to worry about when translating this design to an IC are the RAM, boundary scan and eFuse macros, and perhaps slightly less so the PLL and ADC blocks. While these are not trivial blocks to be worried about, there may be things we can do at a design level to complicate attempts to bake back doors into these blocks, and we're investigating methods to verify their correct in-silicon construction non-destructively.