It doesn't seem to provide much value to bad actors, since you can't trigger this exploit without physical access and a reboot, can't get any device data withou

It doesn't seem to provide much value to bad actors, since you can't trigger this exploit without physical access and a reboot, can't get any device data without the passcode even if you've done that, and can't persist anything that requires privileged access even with the exploit and the passcode. That makes it moderately useful for hackers and security researchers trying to experiment with devices they own, and most likely of little to no use for any hostile agents, with or without physical device access.