For client devices who PXE boot (rare) and also are on Ethernet during boot (basically desktops and docked laptops) and also reachable by pings (so the attacker needs to be inside the network).
Some networks carry ICMP through untouched. Why you'd be using public addresses for your systems between DHCP and PXE boot is beyond me, but it's possible. However, someone would need to spray and pray because they wouldn't have visibility within the network to know about the DHCP and PXE traffic actually happening at that time.
