So, if the UEFI firmware trusts a Microsoft tool that Microsoft trusted a third-party to make and that isn’t open source, it’s not the firmware provider’s fault?

Isn’t this like saying it’s OK for Boeing to be shit because a subcontractor assembled the plane with poorly investigated used parts?