I can confirm that I studied the schematics and that kill switches really do switching on the hardware level which is not programmable. Some signal paths from them to actual power cut are more complex than others but it is quite complex task to distribute power without higher lost. So the power is distributed mostly on variable battery level 3.4 to 4.3 V and converted to required voltages in place of its use. There is wired/diodes/resistors logic to combine switches together for GPS switch off and rescue boot combination function. I am not sure if this passive logic does not draw more power than some advanced LVTTL chip. As for the components I can imagine some scenarios when some components can be powered by some I/O pin which is not cut. But most of connections to i.MX8M goes through level shifters so even that possibility is eliminated and I consider driving mobile baseband or WiFi through GPIO pin to the level that it can communicate as impossible. So even if some signal is omitted it cannot result in unsafe state.
What is a shame that at least components placement is not provided. Self-repair and experimenting with GPS antenna and other stuff is quite difficult without it and for these really paranoiac even possibility to check for tamper is much more difficult. It is even more shame that previous iterations was highlighted to provide X-rays scans etc… But world is not perfect… and I have knowledge at least to have some remote idea about amount of work to reach actual state… in i.mx1 days we have started from really chip level with zero lines of other code and with only self compiled GNU tools and serial bootstrap code and building own JTAG only later when already made Linux kernel and RTEMS system boot on the device.