[1] https://dogber1.blogspot.com/2009/05/table-of-reverse-engine...
with this feature, Apple HQ can give a service center the ability to clear a particular firmware password without giving them a universal backdoor (hardware or software).
Presario FTW!
It makes me somewhat happy in a weird way to think that, even in notoriously locked-down and secretive companies like Apple, there are individuals who don't believe in and subvert the company's attempts to have sole control of its products. We have these individuals to thank for schematics, parts, and a lot of other material that feeds the third-party repair industry.
Makes me wonder if their SCBO generating system is connected to their stolen serial number db (probably not)
In theory only Apple employees can sign the unlock files. How many employees have access to sign these unlock files? 10? 100? Every low-level employee? There may be some "bad apple" employees selling the signing of unlock files, some social engineering to trick Apple into providing signed files they shouldn't be, or a vulnerability the researcher has not found that allows attackers to bypass the public-key crypto implementation.
The number of people that can unlock it is probably quite high, this isn't that different than removing an apple id from the device you need to go to the apple store with the device and proof of purchase and they do it for you.
Edit: I guess this is the slightly better answer than simply yes or no:
"If you lost your firmware password you can now reset it yourself as long the SPI flash chip is not the new BGA type (newer Macs are using them but there is a sneaky debug port that can be used for this same purpose!). You just need a device to dump the flash chip, remove the variable and reflash the modified version, or directly remove the variable (I always prefer to full dump and reflash). Of course this information can be used by thieves selling stolen Macs, but given that there are already defeat devices being sold all over the web, this post does not reveal any previously-unknown secrets."
Or the good old FireWire DMA trick?
Even when they did, enabling a firmware password disabled FireWire DMA, even after boot. (And I'm not sure it was ever active during preboot.)
