Yeah but that just lets them replace the OS that gets booted.

This gives the attacker access at the UEFI level and above -- they can use it to produce false attestations.

Do any of the locked down consoles or phones use a vulnerable UEFI implementation by any chance?