security and blobs

But for someone who cares about freedom to the point of meticulously selecting hardware that will run with only free software, allowing such nonfree web blobs to run is undesirable to begin with. Installing nonfree programs that don't permit auditing is also out of the question.

If you meticulously selected hardware that runs only with free software, there won't be blobs to need to be replaced, making the whole point of linux-libre kinda moot.

And just because hardware still runs with linux-libre doesn't mean that it's "hardware that runs only with free software". Those blobs and their update mechanisms are still around, you just removed the update frontend. As such linux-libre isn't even suitable as kind of a buying guide ("if it runs linux-libre, it's Free™ enough")