if a vendor makes use of the Windows Platform Binary Table then it can use the UEFI to persist even through a format. This is how Lenovo did the superfish thing (also used by various asset-theft-tracking services) and afaik it was never removed from Windows or the UEFI, Lenovo was just shamed into not using it.