Yes, presumably there will be a cat and mouse game until the entire system including all peripherals has been brought into the trusted computing base, either physically or logically (usually with secured/authenticated communication). This has been the case for all applications of trusted computing.

Security is never a binary property, however, and can usually be better expressed in terms of how expensive it would be to subvert a given mechanism. "This image is either authentic or would have cost at least $x to fake" is already much more useful than nothing at all even without $x trending to infinity.