[judge2020]

Right now you'd need a zero-day bootrom exploit to do something like this - still a possibility for the average high-level intelligence operative, but not the average white collar citizen. The proposal is making such a thing a feature.

[shakna]

Stuxnet did not require a bootrom zero day. Just people's propensity to plug in USB devices out of curiosity.

You don't need the NSA to target someone and replace their device with a malware driven one. Just a porch pirate and your own delivery - two to three years and you're almost guaranteed an attack window.