FSP loading SMM

[ArthurHeymans]

The industry is moving away from SMM for security and performance reasons.
So as little SMM as possible is desirable and if it is required then having it open source so it can be audited is a must for security.
Moving SMM loading into FSP is therefore a huge security setback.
What is the rationale behind this proposal?

[tlaurion]

Coreboot mailing list trace of coreboot SMM security issue introduced in coreboot 4.13 (optional), set as default under 4.14 and fixed under 4.17: https://mail.coreboot.org/hyperkitty/list/[email protected]/message/DQHCWQO65KPAOJ2HTE5FY64ZHTO64ECD/

Why is the newer FSP proposal going in the opposite direction?