So I believe this rules out a supply chain attack where someone buys a bunch of CPUs, infects them, repackages them and sells them as new.
If you can't do that, then this feels significantly less problematic.
If you can't do that, then this feels significantly less problematic.