Comment by octoberfranklin

Yeah but that just lets them replace the OS that gets booted.

This gives the attacker access at the UEFI level and above -- they can use it to produce false attestations.