> So you already have to be in ring 0.

Yes, but the article implies that you can e.g. do bad things in a bootloader and then have the OS run while the exploit stays resident and undetected by the OS.

This definitely has previously undocumented exploit potential if you can force the target to e.g. boot from a malicious USB device.