Then just require the efivars to have different semantics, just have a look like unbind works for drivers. If you really want to be super cautious, add a safeguard to enable this.

    echo 1       >/sys/...efi.../enable_remove
    echo varname >/sys/...efi.../remove_var