Depending on how the UEFI is configured, a simple copy/paste command, executed either by the malicious image or with physical access, is in many cases all that’s required to place the malicious image into what’s known as the ESP, short for EFI System Partition, a region of the hard drive that stores boot loaders, kernel images, and any device drivers, system utilities, or other data files needed before the main OS loads.
Didn’t apple use to delete your local music and replace it with whatever remastered re-re-release bullshit? Even if they don’t do it anymore, it was shitty in their part and I wouldn’t trust them anymore. Also, their app on Android doesn’t support casting to other devices… At least it didn’t work as it should when I last tried.