Trisquel is fully free. Even free software has (security) bugs. Developers
can respect the essential freedoms of the users (by picking a free software
license). They cannot promise to not commit any error, to be perfect.
The same actually holds for governments: the "Declaration of the Rights of
Man and of the Citizen" for instance, does not say that "safety is the first
right". There is no such right. That modern talk is bullshit. The
governments should promise not to abuse their powers, to let the people
ultimately decide (popular sovereignty), etc. They should never promise the
people will be safe against any attack, forever. First of all, it is
impossible to hold such a promise. Then, governments that do promise safery
(there are more and more...) end up establishing police states where actual
rights (unlike "safety") are violated: the rights to privacy, to free
expression, to free association, etc.
Anyway, the UEFI discussed here is below the OS. Not part of it.