&gt; In any case, you would end up needing a way to mount it RW to accommodate legit uses of the non-broken EFI vars, at which point you&#x27;re back where you started.<p>Not necessarily. Leaving it &quot;wide open&quot; for anything to accidentally write to it all of the time vs. just mounting it readwrite when you <i>actually</i> need to write to it are two different risk profiles.