It certainly is a vulnerability, because SMM is a higher privilege level than root.

(The fact that there is such a thing as a higher privilege level than root is what annoys people).