I think I'm right in thinking Intel Macs use EFI.
I heard rumours that you can create low-level password protection and even install a shell. Info is sparse and limited.
Have any power users hacked their Mac EFI? If so, what did you do and how?
Yes, you can install a shell. You can also setup a firmware password, though you generally use utilities that run under Mac OS X to set it up (Apple include's
EFI is probably less interesting from an hobbyist perspective than OpenFirmware was. Even if you install an EFI shell, you only have access to a limited scripting environment (basically akin to bash), unlike OpenFirmware where you could actually write substantial things directly in Forth (up to and including writing boot drivers directly at the console without a separate OS and toolchain).
In order to do anything serious with EFI you need to build a cross compile toolchain to compile to native code or EBC, and once you do that you might as well just compile a standalone binary and make it look like a boot vector and just have the firmware boot your code like an OS.