That's how I read it as well. Kind of rephrasing "I don't know why anyone trusts them after all their high-profile security problems, I wouldn't be surprised if their BIOS was unsigned code loaded over an unsecured HTTP connection."