What's funny is that "Allow Execute" and "Query User" options are breaking UEFI specification
They're giving the user freedom, which the specification is against. IMHO they chose the right path. Willful disobedience applies to software too. My opinion of MSI just got a little better.
MSI did not add any of these features, they are available in EDK II. https://github.com/tianocore/edk2/blob/9ce09870e721efacc41fa...
It's been a sad state of affairs.
So it's not that some evil maid could replace the boot chain and update the firmware settings to make it behave as if nothing happened.
Just for those folks who use and want it.
And maybe also introduce a TOFU model i.e. "allow execute" but ask when the hash changes, so booting the same unsigned binary is OK but updates aren't silently allowed and require a quick confirmation (possibly with a timer for unattended reboots). Won't help against physical attacker but should help against a malware that manages to get root and tries to install itself into the boot chain.
Meanwhile, there is a really weird segment of "security people" that focus a whole lot about attestation and signatures and "secure boot" and the like but very little about what actually ends up breaking systems. Call it the Sony syndrome where you ship 15 layers of chainloaded bootloaders and security systems but don't bother updating the years old WebKit. Apple has it too, always money around for implementing another mitigation scheme in XNU but if you ask why nobody updated the outdated open-source PDF library embedded in their Objective C messaging program it's crickets.
Well, it's another level of sophistication, requiring some more investment?
Replacing a bootloader or a kernel (or initrd) and disabling Secure Boot is easy for just about anyone with 5-10 minutes access to a machine. A modified keyboard is less so.
IMHO if you're truly worthy enough to be targeted by such attacks, "secure" boot isn't going to stop them.