In fact, this only works if combined with a Secure Boot disabling exploit. Secure boot (despite the MS key...thing) still would prevent the modified bootmgr.efi from booting.

The article works very hard to bury that bit.