Without secure boot, if there's a flaw in the firmware, an attacker may be able to achieve persistence (as in: having the ability to keep the device infected even after power-off/power-on) by injecting code that the ESP32 will run somehow, then using that to re-write the program on the flash. As ...