Lenovo coded a backdoor and then also leaked the master key to that backdoor (the article doesn't make it super clear, but it seems like the leaked UEFI drivers

Lenovo coded a backdoor and then also leaked the master key to that backdoor (the article doesn't make it super clear, but it seems like the leaked UEFI drivers have some special Lenovo sauce that lets them bypass even secure boot???) None of this is specific to UEFI, and the exploit doesn't abuse any attack surface added by UEFI that wouldn't exist in a mythical alternative.