Tianocore EDK2, which they plan on using, is the reference UEFI implementation and is BSD-licensed. ARM actually develops and maintains the ARM-specific parts of the implementation.
Some people (e.g. authors of [1]) consider the UEFI reference implementation to be of poor quality. There was an exploitable (for privilege escalation from typical userspace administrator to system management mode) integer overflow there, and it wasn't a particularly tricky one[1].