Say you want to attack a machine that has Windows installed. One choice is to compromise part of the Windows trust chain. If that's been implemented competently then that's difficult. Alternatively, take a signed copy of Linux that allows arbitrary ring 0 code execution, boot that, modify the firmware entry points so that they call out to your code and then chain into the Windows bootloader. The kernel boots fast enough that you've only added a second or two to the Windows boot time, but you've compromised what was supposed to be a trusted system.