[acdha]

These attacks have all been well understood as possible within the security community for years. People have demonstrated firmware exploits at security conferences and things like Microsoft's secure boot were explicitly designed to prevent this kind of threat.

Put another way, if you found that an intelligence agency had cool lock-picking tech would it change anything? Maybe it's surprisingly fast, leaves fewer traces, etc. but … it's not exactly a secret that they're in this business and this kind of thing is far less troubling than wide-scale surveillance because it still requires explicitly targeting specific people.