The things that make it difficult to do this are only obstacles to adversaries that don't have access to Intel's secret keys. If you have those, by design you can both bypass secure boot and reflash the BIOS with whatever code you like, and the very same restrictions that stop normal users from doing those things also make it impossible for them to detect that it's happened. The NSA has an entire well-funded division dedicated to helping enable eavesdropping by retrieving information like those keys.

Those security features are genuinely only useful for stopping people from installing Linux and open BIOSes. They can only protect computers from their users, not from the NSA.