Matthew's article mentions that. If you have a version of Grub that can boot in a secure boot scenario but will run any kernel, then it can be used to subvert the system (e.g. create a new UEFI environment that claims to have secure boot enabled and then boot Windows with it).
While Windows 8 lets you run unsigned applications, it seems that it won't let you load unsigned drivers so that is a bit different to Grub running arbitrary kernels.