It needs to run from FLASH and not an EFI partition.
It needs to run at startup before the boot loader and OS.
This is in order to make it non-removable and unskippable, unlike apps in /EFI/BOOT.
I am aware of the other options you've mentioned, I've even done it on a real machine.