Because it honestly is. Sure supply chain attack is possible, but that is true for any stack with binary blob anywhere. Also, on the comment at the video someone said that the 0x3F opcode is vendor-specific debug commands. So from the organization of the opcode, it can already be inferred that it is indeed a debug interface