They have a lot of power, and plugging something like a thunderbolt device in can load an option ROM that runs there [1]. It is one of the reasons linuxboot is such an important project [2]. There is a great talk on why linuxboot is required [3].

[1] https://trmm.net/Thunderstrike [2] https://www.linuxboot.org [3] https://trmm.net/LinuxBoot_34c3

No, they are not. Which makes sense, given it's intended for things like bootloaders, hardware diagnostics, etc which will need full access to the system.

Did you mean something by "execution environment" that wouldn't allow arbitrary programs to run but would allow bootloaders? I'd imagine the simplest way to run bootloaders would be to just run them like anything else.

UEFI execution environment is definitely there.

And it’s mainly used to execute OS-loaders.

Some firmwares even come with a MS-DOS like UEFI shell.

They run in ring -2. Proprietary software with networking stacks, file systems, device drivers, web servers, all running in a mode more privileged than the operating system. There's also the Intel Management Engine with pretty much the same features but running in ring -3.

https://www.youtube.com/watch?v=iffTJ1vPCSo