when they could just as well get their malware EFI module signed by MS This is exactly what the FBI tried with Apple, causing an enormous public mud fight. Be

when they could just as well get their malware EFI module signed by MS This is exactly what the FBI tried with Apple, causing an enormous public mud fight. Besides, the outlined method would rather be deployed by NSA, or maybe a foreign service, without legal means to get a signed malware module. Even if such legal means would exist, it would be in Microsofts best interest to fight them in court: once leaked, the malware would be clearly attributable to MS.