Check out trmml's thunderstrike for an example of a working hardware worm.
Its not exactly what you are outlining, but close enough for me to think 'yeah, does not need a nation-state level actor to do'.
It would be a different exploit chain for HDMI, and I am no expert in either HDMI or thunderbolt to make a claim that its possible, but I've been surprised with the amount of complexity HDMI offers.