In a nutshell, recent hardware-aided trusted execution support ensures that code and data outside the CPU is handled in an encrypted form and only decrypted, while being processed by a secured execution context inside the CPU.
Can I ask a basic question? What is code? Is code a smart contract compiled into WASM?