It could still do a firmware-level keylogger, it's the same technique that it would use to bypass FireVault.