Hazey on Nostr: Isn't the BIOS/UEFI firmware closed source? Meaning the attack vector is by ...

Isn't the BIOS/UEFI firmware closed source? Meaning the attack vector is by intelligence agencies being allowed to install their blobs into the image pre signing?