In 10.12.6 (and perhaps earlier) there's already a /usr/libexec/firmwarecheckers directory. It contains an "ethcheck" binary (with some odd permissions, "-rwx--x--x"... why allow other users to execute it but not read it?).

One of the options provided is: "ethcheck --send-change-in-firmware enable: Will allow ethcheck to send unexpected change in firmware binary to Apple."

Is stuff like "Thunderstrike 2" ( https://arstechnica.com/gadgets/2015/08/thunderstrike-2-root... ) common enough that they expect to find it in the wild and are scanning for this?