- The most glaring issue on modern Intel hardware (beyond year ~2008) is the Management Engine. This is a separate processor that exists in all Intel chipsets past the year ~2006; some systems between those years can have the Management Engine firmware removed (with the ME processor permanently deactivated), but not replaced (due to cryptographic signature checking on the firmware) - see ../docs/hcl/gm45_remove_me.html. The management engine provides remote access capabilities, independently from the running operating system. It has full access to your RAM, and it has full networking support. It also handles the TPM module, AMT (Active Management Technology), Boot Guard and various DRM mechanisms. The ME also performs some basic hardware initialization and power management, on recent systems.
All modern Intel systems built after around the year 2008 (after ICH9) require this blob, and will not boot without it (or will shut down after 30 minutes). Replacing it is impossible, unless you are Intel (only they have the private key, necessary for signing the firmware). The Management Engine is covered on a lot of websites (e.g. me.bios.io, smashthestack.org, the coreboot wiki, wikipedia, FSF blog) and a book titled Platform Embedded Security Technology Revealed (PESTR), published by Apress (ISBN 9781430265719).
The Management Engine processor is an ARC microcontroller. The firmware is based on ThreadX RTOS, which is an embedded operating system designed specifically for those chips. Manufacturers (not just Intel) can pay for a (proprietary) license providing access to the source code, but they are not allowed to share it with anyone. In other words, even if Intel wanted to release the source code for this blob, they could not do so. Even if they did, the ME firmware is cryptographically signed, where the signature is verified at boot time. If you try to use your own modified version of the ME firmware, it will be rejected by the ARC processor and your system will not boot. In other words, the ME firmware is tivoized.
The Management Engine is a giant backdoor, allowing full access to your entire system for malicious adversaries. The libreboot project strongly recommends that you avoid it entirely, and this means avoiding the latest generation of Intel hardware.