Wasn't clear to me from the article whether the firmware was modified via the BMC's network interface or whether it was done locally over some hardware interface exposed to the customer's OS. Was this really done over the network?
Softlayer runs two separate networks, the public network, and the private network (vlans per customer, but also Softlayer tools are accessible from customer vlan, and customer vlan is accessible to Softlayer tools). The BMCs are connected to the private network. My understanding is that access to the BMC via the network is password protected, and customers don't get a password with enough access to flash via the network. Of course, older versions of the Supermicro BMC firmware had network accessible vulnerabilities, and current versions may have vulnerabilities as well. But impitool from the host can configure the BMC, and I suspect either flash the BMC or at least configure the BMC with a user that can flash it (or Supermicro tools can likely be run on the host to flash the BMC)