там дальше же написано.

отсюда читай:

Wait, am I saying Macs EFI can be rootkitted from userland without all the tricks from Thunderbolt that Trammell presented? Yes I am! And that is one hell of a hole :-). Let me show you how it happens.

и далее по тексту