The LoadFile APIs (PPI and protocol) do not return sufficient data, as apparent from the subsequent header-parsing in PeiCore[1]. This is unfortunate for many reasons, e.g. the caller may assume the loader ensured sanity conditions it did not, or it may duplicate verification logic already performed.

To mitigate TOC/TOU, PE files must be read entirely into memory first no matter the source, so I believe reading a file and loading (as in expanding to the loaded address space, relocating, etc) should be two very distinct steps, not abstracted by a single protocol. For convenience, a wrapper library could be provided.

This is an issue with the UEFI PI and UEFI specifications and is submitted mainly for discussion/feedback and tracking reasons.

[1] https://github.com/tianocore/edk2/blob/2072c22a0d63c780b0cc6377f6d4ffb116ad6144/MdeModulePkg/Core/Pei/Image/Image.c#L912-L926