It's also the good reason why having systemd mount efivars read-only would have been the wrong thing to do.