This specific implementation does. What's stopping firmware from patching GRUB to patch the kernel to do things it's not supposed to do? There is nothing inher

This specific implementation does. What's stopping firmware from patching GRUB to patch the kernel to do things it's not supposed to do? There is nothing inherent to Linux that makes it invulnerable to this kind of thing. If you can't trust the underlying hardware or firmware, you cannot trust the machine.