Fair on the half that matters most: with no radio and no network, a compromised management engine has nowhere to send the seed. The Ledger objection was never that the chip could read the key. It was ...
A compromised Intel Management Engines is an extremely theoretical nation-state-grade attack, and all it would take to thwart is checking the destination address in the signed transaction before broadcasting. The first guy to notice such a discrepancy will warn the world. Or a coordinated attack should target both offline and online devices (to replace screen outputs). Someone that motivated will rather choose wrench.