Revise - More on physical RAM

doc/threat_model/threat_model.md

@@ -194,15 +194,12 @@ locked by blowing the fuses.
 - USB port attacks - boot protocol:
 
   - Instead of exiting to an eternal loop on errors, firmware now
-    forces an CPU trap state that requires a reboot.
+    forces a CPU trap state that requires a reboot.
 
 - Software attacks:
 
-  - In earlier releases an access to the RAM address space outside of
-    physical RAM wrapped around to where physical RAM was. From this
-    release access outside of physical RAM forces the CPU into a trap
-    state that requires a reboot. This mitigates hunting around for
-    sensitive data in RAM.
+    Access outside of physical RAM forces the CPU into a trap state
+    that requires a reboot.
 
 ### TK1-23.03.2-Bellatrix
 This release contains a BOM update to the Tkey hardware for the touch
@@ -256,7 +253,7 @@ information, see the [Release Notes](/doc/release_notes.md)
   - The reading and handling of the UDS is randomized so it doesn't
     always occur on the same cycle.
 
-  - Device apps can turn on hardware assisted RAM address and data
+  - Firmware turns on hardware assisted RAM address and data
     scrambling mechanisms. It makes it harder for an outside attacker
     to find assets generated by and stored in the RAM by applications.
     Note that this mitigates an attack from outside the CPU, not from