The firmware code is available in a well known instruction set and, if I'm willing to spend an extended period of time working on it, I can verify that it's not doing anything nasty in SMM. The impact on a vendor of a user discovering that would be pretty huge. The CPU? That's a massively harder problem to solve.

But yes, my biggest problems are that there's no mechanism for anyone else to get their code signed by Google and it's excessively difficult to install user keys. Is there an actual requirement from Google that vendors have jumpers for disabling the write-protect, or is that just an artefact of manufacturer production and testing processes?