I have a Windows 10 OS, drives are encrypted with the latest version. UEFI is not encrypted, and I have recently installed a BIOS update.
I wonder about the possibility of a hacker (if secure boot is disabled) to change the files of the UEFI partition and to alter the BIOS recovery files and therefore use the reset ability to install a malicious BIOS or to alter other files in the UEFI partition that can lead to compromise the whole system or to break VeraCrypt security.
Note that in my system secure boot can be disabled any time due to the ability to reset the power-on password by default by computer manufacturer.