Maybe because a .bmp file could be sent remotely.
Or maybe after the .bmp file is executed, it can install something that opens an outbound TCP connection to its C2, and thus can receive commands. Would not need admin privileges because it doesn't open a port, just 'outbound' connections, like a long-poll.
Sending a BMP file that the user has to open doesn't match what little published details we have:
> The vulnerable system can be exploited without any interaction from any user.
loading story #50387245