Could someone please explain why the Intel Management Engine is such a big deal with Intel's most recent processors?

Being somewhat new to the Purism world, I’d just like to know if I’m missing something. According to this Purism link, out of band system access via Intel AMT/ME is only possible if the Intel CPU supports the vPro feature set. But many of the latest Intel processors (for example the i7-7500 in the latest Lenovo Ideapad 320) do not have the Intel VPro technology, making (per the Purism link above) out of band remote access impossible.

I get that you can’t be too suspicious about something like Intel ME and that it’s therefore a great idea to gut it as much as possible, but isn’t simply avoiding putting Intel Vpro processors in the Librem enough? If I buy a laptop with a non-Vpro Intel processor, could an attacker still remotely turn on & mess with the laptop? What am I missing here?