I'm still using it instead of Sierra because of Karabiner but this could force me to upgrade.
That vulnerability seems to be a pretty obvious oversight. I remember hearing about DMA (in the context of Firewire) as an attack vector since people first started talking of Truecrypt and Filevault and scrubbing the memory seems obvious... It's worrying that this could have been overlooked by Apple's engineers.
I haven't tried it because I can't find the wireless mouse that I needed Karabiner for, but my impression was it has most of the functionality running, especially the key/button remapping which seems to be their biggest use case.
I also have both Shift keys bound to () when pressed alone and Shift when pressed in combination with other keys.
Looks like it's not in master, but somebody has builds that do it.
This is the closest I can find on there to this issue and the fix is Sierra only:
IOFireWireFamily Available for: macOS Sierra 10.12.1 Impact: A local attacker may be able to read kernel memory Description: A memory corruption issue was addressed through improved memory handling. CVE-2016-7608: Brandon Azad
Attribution on that doesn;t look right; TFA was by "Ulf Frisk" who was nowhere on that page.
Why would someone be using El Capitan still, some may ask. Well there is software not updated for Sierra yet. For example, GPG for Mac is not yet ported over.
A nice big finger from Apple to those of us that won't upgrade.
Chances that someone use that device to hack your computer: 0