"newly-released Mac starting with the Mac mini and MacBook Air."

The low-level "Internet Recovery" is custom firmware. And the malware could happen, but it would be like chopping off somebody's head, then re-growing the brainstem into a hijacked mind. Unlikely.

It's much, much easier to hijack an existing install, than to exploit the install, corrupt the hard drive, force a complete re-install of a custom OS built with a malware kernel from somebody else's servers.

EFI is an almost completely open spec, and it's easy to write code that runs within the EFI environment. Combine that with something like the approach taken in Stoned Bootkit and you have a viable option for persisting malware across reinstalls.

In traditional PCs, BIOS reflash does not require any special signing key, or suchlike, and its trivial in a very small amount of code to splice an option ROM (code that executes automatically during power-on) into the BIOS of the running machine, and reflash it (slightly harder to do reliably). As far as I know current generation Macbooks don't perform any kind of signature check either.

Unlike with traditional PCs, Apple has a relatively small number of hardware revisions, making this kind of attack even easier to implement.