I'm much more upset with the vendors that thought UEFI was a good idea and pushed it, than security researches who discover vulnerabilities in UEFI, no matter how they choose to disclose it.
UEFI vs BIOS itself isn't the issue. UEFI, the specificaiton, is really a nice interface to the hardware. The issue is with specific implementations of UEFI, and the fact that UEFI firmware vendors (much like traditional BIOS firmware vendors) can churn out hacky code and nobody is the wiser.
