You say it like the kernel is, at that moment in time, running, when in fact is just a simple .dll file just sitting there and is being manipulated by the uefi

You say it like the kernel is, at that moment in time, running, when in fact is just a simple .dll file just sitting there and is being manipulated by the uefi no different than what Notepad does to a text file. Also the article says it clearly that the uefi rootkit is searching and replacing functions within the kernel and then putting them back once the next phase is complete, in order to avoid security check. Hooking in windows is a technique allowed by the OS, while this "hooking" is nothing more than just simple search/replace file operation. That's being taught like in 1st month on any coding school.