You probably already have addressed this, so you can ignore this. UEFI support for MBR partitions is quite confusing.
Shouldn't the disk have a GPT partition, not an MBR partition, to boot in UEFI without BIOS legacy mode (Compatibility Support Module)? Doesn't Secure Boot need to be turned off in the firmware too? I think Debian is using shim for Secure Boot to work (as the root of trust). Also, doesn't the EFI System Partition(FAT32) need both the grub-efi file (\EFI\debian\grubia*.efi) and bootloader file (\EFI\boot\boot*.efi)*?--there other options for not having a boot file which are probably being used.https://wiki.debian.org/UEFIhttps://wiki.debian.org/SecureBoothttps://uefi.org/specifications/