Bingo! While preventing a user from accidentally hosing their system due to a bad firmware implementation this still does nothing to address potential malware,

Bingo! While preventing a user from accidentally hosing their system due to a bad firmware implementation this still does nothing to address potential malware, it's good to have a patch that helps but I think any blame directed at systemd or the kernel devs really needs to be redirected at poor firmware engineering efforts. Mounting efivars as ro is a bandaid, this patch is a bandaid - the real damage is yet to be done!