> Locking down the bootloader and enforcing TEE signatures does stop malware.

I have no idea about the kind of malware you're talking about.