The article says: But they were capable of doing two very important things: telling the device to communicate with one of several anonymous computers elsewhere

The article says: But they were capable of doing two very important things: telling the device to communicate with one of several anonymous computers elsewhere on the internet that were loaded with more complex code; and preparing the device’s operating system to accept this new code. The illicit chips could do all this because they were connected to the baseboard management controller, a kind of superchip that administrators use to remotely log in to problematic servers, giving them access to the most sensitive code even on machines that have crashed or are turned off. To me, that makes it sound like they could download from a remote host and inject code and do literally anything.