The UEFI shells are generally built from open source upstream code. IMO the real issue is that there is something quite wrong with a security model that thinks

The UEFI shells are generally built from open source upstream code. IMO the real issue is that there is something quite wrong with a security model that thinks it’s a problem that someone can run a UEFI shell and modify memory but does not consider it a problem that one can boot their favorite Windows or Linux kernel and act as LocalSystem or root.