Attacks only machines running specific Ubuntu kernels and using specific boot methods. Plus no actual payload. This doesn't yet represent a real risk.
Where we'll be in ten years' time is unknowable, however. I think the Ars commentors who suggested going back to forcing jumper cap swaps or other hardware-mediated access requirements before overwriting the mobo's boot firmware might be on the right track, even if it's inconvenient for large corporate deployments. It's normal for security and convenience to pull in opposite directions, and sometimes you just have to grin and bear it.
Mental inertia. It's the same kind of thinking that keeps some people using Windows. They've convinced themselves that the option with the familiar name will take less effort to learn than the one with the new name, when in fact the mental effort required to make the familiar-named thing work properly is greater.