The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information.
This exploit is in the VROM
The VROM doesn't sig check the stuff it jumps to in the NOR. So to use the exploit, one finds a way of writing to the NOR unsigned, either with iBoot hacks or kernel patches.