From what I understood this could attack systems using the MBR, non UEFI systems or using an hybrid approach, which is not encrypted nor protected, thus the program can rewrite it and it fits within its boundaries. As it is run before control is passed to the OS, the OS can't do anything at all. If the attacker has physical access and can write the MBR or if there's a privilege escalation good enough to grant itself access to the MBR, you're powned. But I couldn't tell if UEFI protects its partition table in some way.