Windows machines have things like TPM and Secure boot to help protect against firmware rootkits, but is Mac any safer in these regards? How does Mac work in the boot stage and is it any less suceptable to firmware rootkits? Are there any things like TPM and Secure boot for Mac to protect against these security problems?
Are there any things like TPM and Secure boot for Mac to protect against these security problems?
Short version: Yes, and recent Macs have some very good security features like hardware-based RAM encryption that helps defeat things like freezing the physical RAM. I'm not sure I can give a good comparison of Mac vs. non-Mac hardware or firmware security in general; hopefully other answers can fill in more there. Instead, I want to focus on one area you mentioned.
"Evil maid" attacks are going to be largely undeterred. An easy form of evil maid attack (especially if you expect to get access to the machine more than once) is a hardware keylogger placed inside the machine, and Macs are no less vulnerable to that than PCs (they need some special tools, but so do many PCs). The keylogger just intercepts and logs the data flowing between the keyboard and the motherboard, and there's no opportunity for software to detect its presence. When the user boots the machine, they enter their FileVault password (which is probably also their login password), and the keylogger logs this. Later, the attacker opens up the machine to extract the keylogger again (or, if it's an especially fancy one, accesses its log via radio or Internet) to read the password out again.
There's nothing the OS or hardware can do to protect itself or your data, if the attacker is able to flawlessly authenticate as you.