The APIC's registers are an unusual form of per core black magic. As far as I know, no other memory addresses behave in the same way -- visible and reacting only to that specific core. It's unsurprising that Intel initially didn't catch this case.
Fortunately, it's `just` a root => SMM escalation, which are already more common than anyone would really like to admit.
The presentation certainly makes it seem that way. The dramatic "POC" with the magic number only works with the rootkit already installed.
The proceedings paper has much more detail[1]. Installing the rootkit requires some very careful crafting and requires ring 0 to request memory remapping and set up far pointer descriptors.
Fortunately, it's `just` a root => SMM escalation, which are already more common than anyone would really like to admit.