Solved
I posted this on https://www.redhat.com/archives/virt-tools-list/2017-August/msg00210.html
Laszlo Ersek posted the solution: https://www.redhat.com/archives/virt-tools-list/2017-August/msg00244.html
It can be mitigated manually: when the VM boots, interrupt it at the
TianoCore splash screen. In the setup utility, navigate to:
Boot Maintenance Manager
Boot Options
Add Boot Option
In the file chooser, select
<whatever device you have>/EFI/fedora/shim.efi
and enter a description (name) for the boot option.
Then,
Boot Maintenance Manager
Boot Options
Change Boot Order
and move the new boot option to the top of the list.
After you commit the changes, you can forcibly reset the VM, or else
return to the setup TUI front page, and select Reset there.