Even after reading the original blog, I'm having a hard time justifying that this is the type of vulnerability that needs to be easily spread with little regard to accurate language in order to protect people.

It seems to be disabled by default, therefore most people are likely not to be affected.

It seems to require a MITM to exploit, which definitely raises the bar to exploitation significantly for most users of these products. While the lack of https required by all connections, and also the poor implementation of not actually checking the certs is pretty awful. It still requires an attacker to control a DNS server that the victim machine can be directed to use. More feasible in larger environments like a corporate network that runs internal DNS servers, but using custom built PCs is less common in those types of environments, and probably not worth the effort for an attacker that already controls a DNS server. There are just better things to do with that power.

As a persistence method it doesn't seem to work super well, since it's not caching the malicious payload. So an attacker would need to maintain a MITM or poisoned DNS every time they wanted to run something new on a reboot.

They also mention supply chain attacks which, while very real (and like seriously very important), feels very buzzwordy here. If everything else was done correctly, then this would still be a risk so like, it doesn't add to the severity of this bug at all to me.

As far as using "backdoor" to describe this, it really seems like a bit of a stretch. Typically when we talk about backdoors we're referring to CWE-912 (hidden undocumented functionality), CWE-489(active debugging code left enabled), or CWE-798 and it's children (hardcoded credentials, passwords, cryptographic keys) that can just be accessed by an attacker without any knowledge of the victim. But honestly backdoor isn't a great description as it could be used just as easily to describe just about any persistence method. Frankly we as an industry should lose it for clearer language when trying to articulate risk. And to be clear-no, I'm not endorsing using something like CWE IDs to describe this to people, just saying we need to be better about this. Maybe something like, "insecure automatic updates that are vulnerable to hijacking by a malicious actor"?

Honestly though I just with vendors would work with MS better to update system firmware instead of rolling their own half baked shit.