Really hope Lenovo respond soon. Feel like I should leave my ThinkPads hibernated for now.
In other words, while this could definitely make an attack more damaging and harder to remove, it doesn't seem like a reason to stop using a computer that has decent software and physical security.
If you can get someone to run a USB that'll boot you open the user up to a bazillion exploits already and already own the machine.
I'm assuming that would probably need admin/root access to exploit, but it does mean that you can turn an OS-level privilege escalation bug into something substantially more persistent and difficult to recover from.
indeed countermeasure like full disk encryption, computrace and Mac firmware passwords are all examples of things we do to raise the difficulty for a physical attacker.
BTW, I have physical access.