The same vector is applicable for Microsofts loader, so not really one that only the externals are susceptible and again no benefit in security.

Microsoft doesn't signs arbitrary bootloaders, normally just the shim from RH that needs to have a list of earlier signed 2nd stage bootloader (versions) with now known security issues and reject them.