It has been 13 years since the Xbox One released and this is the first demonstration of unsigned code execution.
What's unexpected, and what makes this newsworthy, is how long it has taken.
If kilobytes of storage and very limited computing power works for your use case, you can get very secure (smartcards and secure elements remain essentially undefeated at the hardware level; all attacks I know happened via weak ciphers).
For an entire current-gen gaming console, you'll have a much harder time.