Sure, but there's not exactly a shortage of privilege-escalation exploits around. It doesn't seem like this is exactly a drive-by "oh please look at this resum

Sure, but there's not exactly a shortage of privilege-escalation exploits around. It doesn't seem like this is exactly a drive-by "oh please look at this resume.rtf.doc" type of attack, but it could become one with time if it goes on too long. Somebody would just need to stack things up in the right way, to get privileges in the OS and then from there inject the EFI code. That'd be a heck of a rootkit.