Windows does do that. Crowdstrike sticks it back in at the UEFI level by the looks, because you know, "security".