Found when testing with openQA in my local instance:
With QEMU and UEFI SecureBoot active, the safe mode boot entry (the second entry) will not boot properly. It hangs.
The nomodeset kernel option was added in 2010-06-24, which IMO still would make sense for a BIOS-based boot sequence.
I chose to hardcode the removal of nomodeset from the LB_BOOTAPPEND_LIVE_FAILSAFE variable.
An alternative solution would be to introduce a new command line option, --bootappend-live-failsafe-bios in addition to the already existing --bootappend-live-failsafe.
--bootappend-live-failsafe would copy its value + nomodeset per default to --bootappend-live-failsafe-bios.
I would however rather avoid yet another command line option.