The culprit purportedly comes from a customer PE loader, which allows any UEFI binary to be loaded, even unsigned ones.

They don’t even have to be signed…

Here is an example of something similar that disables Windows Platform Binary Table…(I’m not advocating that anybody actually use this).

WPBT is another terrible ‘feature’ of UEFI/windows that lets motherboard manufacturers install their bloatware even on fresh installs of the OS. First boot of a fresh OS the app will already be installed. Uninstall it and reboot…installed again. You literally need to dig through their bios options to tell it to stop. They usually make that quite the process too. Bios update? You can almost guarantee they turned it back on and probably relocated it in the menus.

Don’t really feel like that’s their first attempt at something like that. So they probably have a carving saw which is made for stuff like this.