I can't judge their intentions. But Bloomberg doubling down on the story in 2021 strongly discounts the possibility that the original reporting was based on any kind of bad info.
ref: https://www.datacenterdynamics.com/en/news/years-later-bloom...
Three years is a long time to believe in bad data, with everyone everywhere pointing out the same issues with their story.
Still kind of reads like someone told us there was a bad chip on the motherboard. And there was, and it was the BMC/firmware for the BMC.
Did SuperMicro (or their suppliers) just write shitty firmware with zero security for their BMCs because that was the industry standard, or was it a Chinese Ministry of State Security plant who did it as part of an evil plot?
Did big companies pull out of SuperMicro because of poor BMC security? Sometimes, a bit, often as just one more checkbox on the way to OCP style defluffed machines; in an early revision of OCP, rather than a BMC, the NIC's wake on lan signal was rerouted to reset, to become reboot on lan. But then OpenBMC happened, cause reboot on lan isn't enough for everyone.
How so? If there was an ulterior motive (I don't know if there was, but it's been suggested) then they'd also double down. They also didn't even attempt to respond to the issues. If they had good information based in reality, a lot of the claims would've been trivial to refute.
Consider: the BMC has access to the system via PCI-e, as well as kvm and comport. In some systems, the BMC is in the path of the main NIC. There have been some major software flaws in BMC software, including revisions that SuperMicro shipped, where passwords could be bypassed in the network interface.
Stuff like this https://web.archive.org/web/20140625065505/http://blog.cari.... and other things on this page http://fish2.com/ipmi/ are all pretty nasty if you thought IPMI was secure in the neighborhood of 2014.