The modern checkm8 continuation patches code signing, mount policy and task ports, and has no page-protection patch at all. What the gap in its own patch set says about the boundary everyone assumes is being crossed.
The bootrom era was unpatchable but fully readable. The userland era inverted both properties: every bug had a fix, and most of the tool’s shipped life has no published source at all.
The boot ROM is the one component no update can reach, so a bug in it is a bug in the hardware’s own trust anchor. What checkm8 established about unpatchable vulnerabilities, read from the public record rather than from a device.