Edit: I was wrong on all counts, see chuckup comment below. This happens after boot in cooperation with the OS. Encryption and secure boot are irrelevant.

I presume this type of firmware enabled OS modification will not be able to work with drive encryption enabled, but does secure boot help at all in this situation? Presumably Lenovo includes their own signing key in their firmware so their signed executables would also be trusted. Or is this not something secure boot would verify?