The volatile-memory protections or access controls are insufficient.
The memory from where the boot loader executes can be modified by an adversary.
(good code)
A good architecture should define appropriate protections or access controls to prevent modification by an adversary or untrusted agent, once the bootloader is authenticated.