They have to gain access to the machine first to do the reflashing. Closed source systems make this a lot easier.

Apple's software update process allows for remote targeting of individual machines by MAC address, for example.