You said it yourself that files on Linux are protected by DAC-style basic Unix permissions. You also noted that FAT filesystems do not store Unix permissions. So how can Unix permissions help here?
Well, how would the filesystem operate at all without some abstraction for permissions? Instead of looking to the filesystem for permissions, the permissions for the entire filesystem are set at mount time. See this question/answer for details, but the important excerpt comes from mount(8) man:
Mount options for fat
(Note: fat is not a separate filesystem, but a common part of the ms‐
dos, umsdos and vfat filesystems.)
uid=value and gid=value
Set the owner and group of all files. (Default: the UID and GID
of the current process.)
So, when /boot/efi
(or /efi
) is mounted, mount
will set the owner and group of all files to root:root
, since the mount is being performed by root.
Let's see this in practice. On my system:
~# mount | grep efi
/dev/nvme0n1p1 on /boot/efi type vfat (rw,relatime,fmask=0077,dmask=0077,codepage=437,iocharset=ascii,shortname=mixed,utf8,errors=remount-ro)
~# grep efi /etc/fstab
UUID=DEAD-BEEF /boot/efi vfat umask=0077 0 1
An explicit UID/GID isn't set, so it will mount as the UID/GID of the calling process. Note the fmask/dmask are set, resulting in permissions being set to 700 for files and directories.
~# ls -al /boot/efi/
total 9
drwx------ 3 root root 4096 Dec 31 1969 .
drwxr-xr-x 5 root root 1024 Nov 10 10:19 ..
drwx------ 4 root root 4096 Nov 7 16:44 EFI
If you were to probe further, you would see that every file and directory under the mountpoint have the same permissions and ownership. If you try to even list the directory contents as an unprivileged user, you obviously get:
nobody@multi3:/tmp$ ls -al /boot/efi
ls: cannot open directory '/boot/efi': Permission denied
So, back to your question:
Why? Just why? How can this be considered safe? Any user of a system
can play with the ESP and do whatever they like. It seems to defeat
any and all sensible security measures.
It is "safe" because it is protected by DAC; Unix permissions. Only root can make changes. So the assertion that "any user of a system" can make changes is incorrect.
Now, I suppose root could change the mount options to allow mounting it as another user, but this would just be silly. But if your threat model includes an untrusted root user, you've got bigger issues to worry about.
All of this is assuming you are referring to the ESP of the currently running system. Of course, as stated in the comments, the partition could be modified by anybody if mounted within another system.