But then again ransomware would happen like you said if they skipped it? And ransomware sounds even worse.
But always a chance that the skipping mechanism could break as well. And there must be some form of networking available to able to send that and ask for approval.
One change - this approval and telemetry doesn't happen during the boot loading process. It's just logged and skipped.
Once bootup is done, the EDR app auto starts, checks logs for anomalies and sends telemetry over whenever network is available (it usually is, because they update malware signatures etc frequently). Someone at the company gets paged, they fix and the process continues.