The article does a poor job of explaining the threat model, but I think you hit on the exact problem here. OOB baseboard management should not have direct access to other OOB management nodes, lest you invite that as an attack vector.

Unfortunately I'm going to bet a notable amount of networks conflate say routing layer and OOB management traffic and don't segregate the two (where often routing protocols need to cross communicate but OOB baseboard management does not.)