> BIOS flashing from the OS has been a thing for a long, long time now. Heck my XPS 13 running Linux even gets BIOS updates from apt-get. UEFI capsule updates

> BIOS flashing from the OS has been a thing for a long, long time now. Heck my XPS 13 running Linux even gets BIOS updates from apt-get. UEFI capsule updates are triggered by the OS, but don't occur in the OS. The updates are copied to the EFI system partition, and on next reboot the firmware is triggered to apply them. The flashing process involves the firmware verifying a signature on the image before applying it. The reason for this is that the firmware flash is locked down at runtime, and most of it can't be written to outside System Management Mode. Halting the entire OS for long enough to flash the firmware isn't realistic, so it makes more sense to do it in the firmware environment instead. In any case, the net effect is that while, yes, you trigger the update from the OS, the OS itself is unable to directly modify the firmware, and if you try to flash a modified image via the capsule update mechanism the firmware will reject it for having an invalid signature.