I think you're overestimating how hard this is, modulo how they implement firmware updates.

EFI is an almost completely open spec, and it's easy to write code that runs within the EFI environment. Combine that with something like the approach taken in Stoned Bootkit and you have a viable option for persisting malware across reinstalls.

In traditional PCs, BIOS reflash does not require any special signing key, or suchlike, and its trivial in a very small amount of code to splice an option ROM (code that executes automatically during power-on) into the BIOS of the running machine, and reflash it (slightly harder to do reliably). As far as I know current generation Macbooks don't perform any kind of signature check either.

Unlike with traditional PCs, Apple has a relatively small number of hardware revisions, making this kind of attack even easier to implement.