I believe they’re assuming that malware can do a pretend reboot whereas the hardware keystroke can’t be faked.