Details on Ubuntu's UEFI secure boot plan

I don't think there's any meaningful distinction between executing arbitrary code before and after ExitBootServices() - the only real difference is that the flash is guaranteed to be locked down afterwards. UEFI doesn't give you access to any legacy BIOS interfaces (the legacy video ROM has tended to be there for various reasons, but that'll be vanishing now), and direct hardware access would mean porting a large number of drivers to grub.