It seems like a pretty valid concern.  Part of the next generation of rootkits seems to be targeted at SMM-level rootkits (termed &quot;ring -1&quot; by some) that are installed in the BIOS.  They are practically undetectable once installed, and can punch through hypervisor protections too.<p>I think that is also part of the author&#x27;s concern with Intel ME being present on all systems.  It is a separate microcontroller in the chipset that has power on the level of &quot;ring -3&quot; (I believe it is used to implement much of the new SGE instruction set, for example).