You could be right. But stuffing megabytes of a full copy of the BMC flash image in such a chip may be overkill. You could just as easily man-in-the-middle bytes sent by the legit flash over the SPI DO line...