It is because the UEFI standard was designed to give the vendors such freedom. The only way to make vendors do the sensible things is to force them with a strict standard as possible, defining almost everything about openness and security. Even in this case there will be vendors who: 1) can't read the specification 2) do the thing their own way 3) obfuscate code for the sake of obfuscation 4) write the code the worst way possible.