"Fix will eventually render all kinds of older Windows boot media unbootable."

I assume this will require all users to create new rescue media - correct?

Microsoft will take nearly a year to finish patching new 0-day Secure Boot bug

If you complete the revocation steps, yes. But as of this writing, Microsoft’s articles suggest that they have not yet themselves released updated versions of old Windows install media and WinPE images that contain the fix. So that would need to happen and then Reflect would need to download the updated content to incorporate it into new Rescue Media. Hopefully Reflect will be able to notice the updated release of the same PE kernel when it becomes available, since Microsoft generally does not update WinPE for a given kernel during its lifecycle. (The various feature releases of Windows 10 and 11 are considered different kernels.)

It’s less clear what will happen for people using WinRE Rescue Media. If the currently available May update also fixes the system’s WinRE partition, then a full rebuild of WinRE Rescue Media should contain the fix. But the documentation isn’t entirely clear on whether the May update alters WinRE. The only mention of WinRE is for OEMs.