The code executed from the trusted execution environment can not be viewed or modified, so an attacker would only be able to execute destructive code with complete privileges on the same processor. For example, https://aistudio.ml