[not_doctorq]

Based on the article, but I’m still not sure if this is the case, it seems like they checked for a specific shim(s), which would be on the EFI partition that everything shares.