Can internal PinePhone firmware be compromised?

[evilbunny]

Let's say I install some untrusted OS on the eMMC, use it, then wipe it. After that I boot from a trusted microSD, can I be sure that I am not compromised?

Unlike regular computers, ARM systems have all the bios-y info stored on the emmc/sdcard,

Wrong;
The ARM system must have some initial loader to start reading from eMMc or sd.card.

I'm led to believe boot is hard coded into the chip. The rest is on emmc/sdcard.