Ominous trips.
Anyhoo.
PXE boot enabled doesn't mean it will boot from a remote machine. That depends on the BIOS boot source sequence.
Also, PXE boot usually boots from a server on the LAN.
CM did mention a Cloud Boot, but I didn't see that BIOS option on the video I looked at.
Biggest takeaway is that for a PXE boot the machine needs a network card. The Dominion CEO is on tape saying the machines have no connectivity potential. Question is why is PXE even enabled?
If the machines have a network connection, even just to a LAN, an appropriate VPN on the router to the WAN gives those machines LAN availability over the WAN.
IOW, some tech sitting any where in the world can work on those machines as if they were on a LAN in the building he was sitting in.
So yes, if there's a network connection they can be manipulated remotely.