I'll take his word that no blobs are running on the main CPU. But the process itself is error prone. It's mounting flash storage with blobs into the filesystem of the OS. The OS can load modules directly from the storage.

> There is not a single non-free blob in the OS that runs there once the bootloader is up (unless you put some there by yourself, which you're of course free to do).

"unless you put some there by yourself, which you're of course free to do" also means unless someone else puts one there.

---

I think the "firmware jail" loader also uses Smart Direct Memory Access (SDMA)?

---

You can run blobs on the main CPU with strong isolation with TEE and other hardware security features.