I mean that ordinarily, as intended by design, Apple has the private key they can use to sign the T2 firmware. You don't have the ability to run any code on the T2 whatsoever. And considering that it sits in the middle of most system buses and is more privileged than the main CPU, effectively controlling the entire thing at all times...