Would this not be mostly thwarted by using full disk encryption and a TPM? FDE means the firmware cannot do anything with your data; just view the disk as a rem

Would this not be mostly thwarted by using full disk encryption and a TPM? FDE means the firmware cannot do anything with your data; just view the disk as a remote server and store like you would on AWS or so. A TPM can then read the boot sector and ensure it hasn't been modified, so the firmware can't take advantage of the unencrypted code there. Of course there's other things the firmware can target, but at least not being able to directly read/write data is a huge bonus. And it'll greatly reduce the surface area for exploits, since just the encrypted block device code can be messed with, not all the internals of various filesystems.