An interesting part of this is actually in defeating secure-boot or bitlocker. If a device is misconfigured for PXE boot with an otherwise locked down UEFI system, and strong secure boot. This could let you break the boot-chain and then disable secure-boot or extract keys from a TPM.
The main question here is how often devices you'd want to try this against have PXE boot enabled. I'm thinking of locked down laptops mostly. Either corporate laptops, or manufacturer locked-down devices (chromebooks, I think some microsoft surfaces).
Servers are locked down these days too, are they not? They may have an encrypted boot image, with keys in TPM, and boot from a PXE provisioning system. Would this offer a path to modify that boot image?
The main question here is how often devices you'd want to try this against have PXE boot enabled. I'm thinking of locked down laptops mostly. Either corporate laptops, or manufacturer locked-down devices (chromebooks, I think some microsoft surfaces).