Microsoft-signed diagnostic tools with backdoor were found in 200,000+ laptops. These legitimate UEFI shells include a memory modification command that can completely disable Secure Boot.
The discovery exposes a fatal flaw in a security model shows that you can't blindly trust components that can bypass every protection, proving that "signed by Microsoft" doesn't mean safe.
https://eclypsium.com/blog/bombshell-the-signed-backdoor-hiding-in-plain-sight-on-framework-devices/