The EFI spec is a horrible disastrous mess, but in theory you could be reading and writing EFIvars at runtime to dynamically configure boots - ie, "reboot to sa

The EFI spec is a horrible disastrous mess, but in theory you could be reading and writing EFIvars at runtime to dynamically configure boots - ie, "reboot to safe mode" would set the evifar next boot parameter to your initram-fs fallback. It would not be complicated to implement pam / polkit support for unprivlidged users to set such things without authenticating root. It does not change the fact the fault lies with shitty proprietary UEFI implementations, and nobody writing free software is at fault here.