this is bad, right?
In a way, yes. . . however, I just went over the video and the article with a fine-tooth comb and I found this:
"Thunderstrike 2 starts with a local root privilege exploit that can load a kernel module to give it access to raw memory [and] can unlock and rewrite the motherboard boot flash," Hudson says.
They don't tell us right out that the Trojan that's required to invade the original "infection" machine has to be running with ROOT privileges. No normal Mac user ever runs with ROOT priveleges. . . not even an Administrator runs with ROOT privileges. That ROOT user is one level above Administrator. . . and is inactive on a normal Mac. The Administrator can reach ROOT commands by use of the SUDO command (SuperUser DO) for single command lines. Or an Administrator can activate a SuperUser by creating a ROOT account—only one is permitted per machine—by creating a Root user Name and password. Then logging in as that ROOT user.
The likelihood of anyone downloading a TROJAN as a ROOT user are somewhere between zero and nil. . . unless the user is industrial strength stupid and then some.