Exactly. An add instruction, or any instruction needs to be carried out in steps within the hardware. Sometimes there's systematic bugs in these implementations that can be exploited.

Plus, it's an open architecture where those bugs can be exposed and fixed. Where in Intel/arm based architectures, they can be rolled out to the world and be used by those in the know.

Eg: https://www.techrepublic.com/article/is-the-intel-management-engine-a-backdoor/