> the US can update it all remotely, including the hardware now thanks to things like intel ME

Let's not be excessively alarmist; AFAIK, the Intel ME is not (unless you're using things like vPro) exposed directly to the network, you need the cooperation of the operating system to reach the ME.

Of course, said operating system is usually Microsoft Windows, which can be updated remotely... (and even Linux users often use USA-based distributions).

According to its specs, but since it's a black box for which we have neither the source nor the design documents, and given that implementing back doors is a regular request from governments, it's a logical concern.