Comment by londons_explore

These firmwares are already fully encrypted but nvidia has been publishing encrypted debug images that turns out could be decrypted with one of their public test keys. And those debug firmwares turned out to be close enough to the production ones that they could be used to construct exploits from.

In this case it's a DMA buffer overflow that writes to the stack which in turn can be exploited with Return Oriented Programming. So no unsigned code is ever executed but we still have code execution control.