Yeah... attacks like LogoFAIL hit during the DXE and BDS phases when the firmware is acting as its own 'mini OS' before the handoff

Easier to comprehend here - https://vectree.io/c/uefi-firmware-architecture-principles