The T2 chip is just an ARM CPU running a customized version of watchOS. So in theory malware could take over control of the T2 chip.

I also wonder what implications on features like the mentioned microphone disconnect that'd have. My guess is that the T2 chip which also acts as audio controller, simply doesn't forward audio signals received from the microphone to macOS if the lid is closed.

Edit: Never mind. After reading further it becomes clear that it's really disconnected in hardware:

This disconnect is implemented in hardware alone, and therefore > prevents any software, even with root or kernel privileges in macOS, and even > the software on the T2 chip, from engaging the microphone when the lid is > closed.