Disagree entirely. With an outdated CPU, you could be owned just by running Javascript on the wrong site. Not so with a vulnerable UEFI/BIOS, that requires additional privesc as is seen here.