I like they use main processing unit from a Dutch company; is its ROM open source or/and can be accessed? All ARM-based Sytem-on-Chips do have a proprietary ROM, which is used mainly for boot-up and multicore management. But there's no access to check if it may do something else. >> The mobile baseband will most likely use ROM loaded firmware this is another vulnerability
The one mutable/loadable blob the i.MX8 requires is firmware for the DDR4 PHY (not training code you run on the CPU, but something that runs on the PHY apparently??) and they're using an embedded tiny cortex-M4 core to just load it: https://puri.sm/posts/librem5-solving-the-first-fsf-ryf-hurd...
(IMO, that's a silly requirement from the FSF, I think keeping the main CPU free of blobs that it doesn't run i.e. blobs for other things does not have any meaningful benefits)