I was talking about the signed recovery shell the article is talking about. Sadly most business laptops still use dtpms. Also if they use ftpms you can simply use a ram scraper. The attack surface is huge either way.