It's a fairly well studied area, deriving unbiased randomness from a consistently biased source eg http://web.eecs.umich.edu/~qstout/abs/AnnProb84.html
The simplest approach I know of is to extract a random bit repeatedly until it transitions from 0 to 1 or 1 to 0, and then use the second result. 50/50 split, regardless of any (constant) bias in the generator.
Also, there is a bit set after executing RDRAND that tells you if you got a 'good' random number.
Does anyone else feel like that's the sort of thing that will become part of a vulnerability someday?
No. It's used as a measure to NOT become part of a vulnerability someday, i.e so the system recheck and ask for another random number.
And generally speaking, it's something you want to avoid in your designs, not only because of the unpredictability of the final output (whether it resolves to a 1 or 0), but also because of the uncertainty in how long it will take to resolve.
But it seems perfect for generating randomness. Neat idea. The real trick here is that it's only theoretically unpredictable. In real life, due to "imperfections" in fabrication, the inverters will be biased to resolve one way more frequently. So you might end up with a 60/40 split, for example.
I see they do address this in the article, and have added some "conditioning" to eliminate the bias... I bet it's described in a patent somewhere.