They are correct. It is certainly possible for malware to migrate between operating systems on the same host, and in many different styles. To better answer this, distinctions should be made between virtual operating systems and dual booting, but at the end of the day, a compromised operating system can can reach out and interface with the host directly, and therefore potentially compromise it.
If we are talking about specifically a dual-boot scenario: Malicious firmware could certainly compromise every OS on the host. So, do we have physical access to boot it from arbitrary firmware? Is the separate OS in question on a separate HDD? What about secure boot options, bios admin passwords, encryption etc? We need to know a lot more to tell you how specifically this is done, I'm trying to give a general outline though.
If we are talking about a virtual scenario: There are a ton of different flavors of attacks surrounding hypervisor sandbox escapes, it's up to you what you do from there. Another user incorrectly stated that whatever attack it is will probably not be persistent, and that is just absolutely wrong. We have no idea what the initial compromise was. If you escaped a hypervisor sandbox or you booted the host from arbitrary firmware... It's game over in terms of persistence and spreading to the entire HDD (depending on the previously-mentioned conditions).
More specific information is required in order to accurately answer this in detail. Do we have physical access to the host? Are the OS's virtualized? Etc. Though the TL;DR is that yes, theoretically malware can certainly spread between OS's on the same host, both in the virtual and dual-boot scenario. Totally different implementations are applied between each, but the same goal is met and is extremely common in the malware research field.
Here is a very-loosely related question that describes the security risks between utilizing virtualization or dual booting: Is there a security benefit of using a Virtual Machine over dual booting?