Well, that's one reason why UEFI sucks. In theory (and don't get me wrong: nobody serious in sec. ever believed this would work in RL) secure boot and signed drivers should prevent "malware" from being installed. But well: certs get stolen and exploits get found. There have already been many papers on that topic. This driver signing BS is more like a salesman argument from UEFI vendors in case anyone asks (as you just did). Story goes like this: Salesman: "yes we're aware of the risks and we're doing some magic that prevents that. Now I'm not an tech guy but our experts say it works. 100%.". Silence. Everybody in the management board nods in approval, IT-sec guy jumps out of the window.
Now while I'm bashing UEFI let's not forget that long before UEFI there have been (many) vendors that enabled you to flash your BIOS from within the OS (very common in the server / enterprise market but I've seen it on high-end enduser mainboard (ASUS WS PRO series) as well). They did that building proprietary chips and interfaces. So this is not a entirely new problem with UEFI and one could argue UEFI made it better because atleast now we have a standard way to fuc* things up. One could also argue that now you don't have to reverse engineer ALL the mainboards because everyone is using the same known vulnerabilities. One could also say that UEFI made it worse due to unnecessary complexity, adding features to a bootloader nobody ever asked for, which increases the chance of bugs in the implementation.
That said please note that there are efforts to do things better. But unfortunately I yet have not had time to dig in deep into what those alternatives do better (maybe someone wiser can elaborate on this topic?) and - as so often in the history of technology - even if those approaches would be better than what UEFI has to offer they will probably always life in the shadow of the crap the industry has choosen (UEFI). So, till the first nuclear power plant explodes and people die I guess we'll have to live with UEFI (and even then I'm not sure something would change when it comes to IT security).
Oh and because you asked: no, there is nothing you can do to prevent malware from doing such an attack. Besides installing something else then UEFI (with potentially other risks and vulnerabilities). I'm not sure about possible "hardware modifications" that would prevent write access to the UEFI env. but if there is a way it'll probably be very hardware specific and probably not easy to DIY.
But let me tell you: if you panic by knowing this now better don't have a look at what Intel did with AMT (hint: AMD has similar BS). And no: you can't turn off that crap either.