Steve Blank says that Intel and AMD processors are vulnerable to malicious microcode updates, which could be sent by the NSA, by Intel, by Microsoft, or maybe by someone else.

When microcode can be changed, it counts as software installed in the computer. Then it needs to be free software.