Each of these "vulnerabilities" seem overblown to me. A lot of these seem to rely on getting access to deeper systems which, in my opinion as an enthusiast, block people from doing whatever they want (I mean, I'd love to be able to edit my own Pascal GPU BIOS like I did in the old days). To actually be attacked with these particular vulnerabilities, you already have to be in a perfect storm of shit anyways. I'd be less worried about these vulnerabilities themselves and more worried about how somebody was able to compromise my systems to the point where these vulnerabilities became an option for them.
I also suspect ulterior motives myself given the nature of these CTS people and those connected to them. At best they seem to have found some vulnerabilities of questionable (in my opinion) severity (they're bad, but really hard to pull off) and are looking to profit from it. They're definitely not a legitimate security firm in my eyes, and their report is obviously made to benefit them, not to merely alert those concerned to the vulnerabilities.
That said, I've followed up on this for a while and read a lot of comments before immediately reaching for my e-torch and e-pitchfork... I don't dismiss the flaws as fake, rather overhyped because they would be very difficult to use in an actual attack against target systems. I also lump CTS in the came category as patent trolls and people who sue other people because their phone also has "rounded corners".
