Thats interesting, and comforting, though is this where the firmware discussed here including u-boot resides?
Also it seems like it can be flashed, so could you clarify what you mean by non-writable?
Yep.
Those are all good points.
I think I had a misunderstanding, I thought the only closed source blobs the L5 had were for the 4G modem, because purism could not find a manufacturer willing to work with them. After looking into it I realized I was wrong. Though I have the understanding the Purism has looked specifically with manufactures who are willing to work with them (lowers risk in my opinion), and stores proprietary firmware on a separate flash chip, I think your more or less correct here. Any differences assessing the threat level would be down to the use case of an eMMC drive vs an SD card. Where and SD card is lower cost and likely to move from computer to computer, the eMMC drive is likely to stay in one machine and is higher cost.