Being that the boot.ini can differ on all machines, isn't your method a way to severely cripple all machines?
One method I was considering testing was to use WriteLine at the last blank line in the boot.ini and adding the exclusion.
It seems like replacing the boot.ini is dangerous, whereas appending to it would be less dangerous (although I would still sweat over this a bit).

Thanks for the FYI on the UDF for SP2 firewall disabling.