While there seems to be verification off the device how do we know the EFI attack isn't aware of this agent and presenting it with legitimate data for it to process while still remaining hidden?

Windows only. OP mentions BSD.