[self_awareness]

And how a malware can use this if it's configured globally in a root:root owned config file?

[drdexebtjl]

Not all package managers require root.

But yeah, maybe through an exploit with a narrow reach. Once in, the malware can veto security updates and escalate to full control.

[self_awareness]

With root, malware can reach out to UEFI anyway, and can do whatever it likes.