The silliest thing about it is probably this. Google seemed to have just kind of forgotten to add code that would verify the rootfs on shims, even though they had everything they needed to do it already set up.
The patch causes a different root filesystem to be used. Specifically, if the kernel command line specifies a root filesystem that must be used, then that one will always be mounted, even if other devices are available.