The attack defeats the whole premise of security in "secure boot". It's high impact in relation to that.

As a user I don't care too much about "secure boot" and its threat model, and I assume you don't either.