Boot Guard is implemented by the ME, in part of the code that still runs in HAP mode. But, crucially, the buffer overflow described there occurs before Boot Guard runs.