Boot Guard is implemented by the ME, in part of the code that still runs in HAP mode. But, crucially, the buffer overflow described there occurs before Boot Guard runs.
Huh. I assumed Boot Guard was a thing that happened in the IntelME bootrom.
I guess I'm too used to similar things in game consoles.