> Windows doesn’t allow you to do that by default unless you’re an admin.
The refutation is that by default users are an admin. So no, they’re not protected against persistent threats like UEFI malware.
Most people are not going to be downloading random executables and running them, since software is managed through App stores nowdays.
One would have to first craft the shellcode insertion into the exploit, which is not exactly trivial, then hope that enough users visit a particular website to get infection (which is a negative feedback loop as the more users visit a website, the more likely it is to get scanned and reported as containing malware), then drop a crafted executable to presumably steal something that is worth money, which is a whole separate problem.
Possible? Definitely. So is you getting held up, your car stolen, and chopped up for parts, with no available recourse. Both are rather unlikely.