You don't need to remove the microcontroller. You can reflash it using a utility, and the researchers showed that IBM was not resetting the BMC firmware between

You don't need to remove the microcontroller. You can reflash it using a utility, and the researchers showed that IBM was not resetting the BMC firmware between clients on that bare-metal server.