I haven't removed an EFI password but I've removed an Apple ID from 2 devices and it was done in <30min at the Apple Store in Westfield (SB) London.

While It's likely that Apple has probably has some audit trail on these requests just the sheer amount of devices that are likely to need to undergo such procedure make it unlikely that there is some room in Apple HQ where 5 highly trusted engineers issue those files.

Even if you don't count all the end users that lock their devices and can't unlock them all the devices that are returned to apple, go in for a hardware replacement/fix or recycling need to undergo a similar procedure. So If I would be asked to wager on how this process is done it would be that it's an automated process with an audit trail just like what many organizations use to reset account details, passwords and other things.

Even if the employees capable of directly signing the files make up a very small group, they would probably be authorizing over the phone or a similar indirect route. This opens the door to social engineering by anyone, employee or not, who knows what number to dial and what information to provide. The tech would be authorizing the file without seeing the customer's device and proof of purchase themselves.

To foolproof the system, you would need less than a dozen people trusted with the ability to sign the files, and require the device and proof of purchase to be shipped to them rather than allowing unlocks to be authorized remotely.

It's unfortunate that the last line of defense against a stolen machine, the firmware password, has a backdoor. I'd have expected a firmware password on a MacBook to be just as difficult to bypass as an iPhone's passcode. Apple refuses to unlock phones, but will gladly remove a firmware password on a real machine. Disappointing.