The UEFI approach also isn't "flashing under Linux". It's "Stash a UEFI capsule somewhere into RAM, suspend, have UEFI update itself on wake-up before returning control to the OS"

Now, having the firmware run a seldomly used code path on resume sounds scary to me: That _must_ be accompanied with some OS-level check (eg hashing) that the firmware didn't touch any memory that it didn't originally reserve.

Luckily Windows is doing that, so Linux can ride the coattail again (as is usual with Intel-originated firmware standards) - except if Windows is guaranteeing some unused memory, because then, some UEFI implementation exploit that, inadvertently breaking things on Linux (yet again).