As far as I understand, when in CSM mode, UEFI boots using MBR boot sector (from internal hard drive, external USB Flash drive, etc). And when in non-CSM mode, UEFI ignores whole existence of MBR boot sector and boots using special EFI partition. Meaning, that even if MBR boot sector is indeed infected, its code will be completely harmless as long as CSM mode is disabled. Is my understanding correct?
This question is theoretical.