@djsumdog >I think some newer boards have their own SoC chip just for ME
Nope.

The ME in 2008 and before ran on an ARC processor built into the NIC chip, but later versions run on a dedicated x86 core built into the CPU substrate - so no SoC to speak of.

>The ME gets its own IP address right?
Yes, otherwise it would conflict with the computer trying to listen on port 16992.

>and on server boards, it often runs on a different physical Ethernet port
I can't find any details on this, but I guess?

A different physical port probably won't make much difference security wise if one Ethernet chipset is handling the ports.