It's rather awkward to me because it runs almost entirely through userspace or eBPF. Both of which are trivial to spoof and bypass.

You can create a fake efivarfs, fake integrity states, etc, and if they actually try to test the integrity features to see if it's true, you can easily determine that and conditionally provide the vanilla behavior.