Dan Farmer, the author, wrote the original SATAN host security scanner. I had some emails with Dan about IPMI circa 2013. His paper is a good restatement of many of the problems of IPMI.
However, in my mind the biggest problem with IPMI, which is not really well elucidated in this paper, is that it turns every machine in to two machines, and compromising either one means you can automatically compromise the other: ie. own the host, own the BMC by flashing it with vendor tools. Own the BMC, own the host by any number of ways including memory manipulation, old-school keyboard input, presenting fake devices to the running kernel, etc.
Unfortunately, it's therefore impossible to ever be completely sure you've got control of a system. In the face of any suspected attack you cannot ever regain control with any confidence whatsoever, even by flashing firmware.