Security hole in firmware password by installing another boot loader?
Yes, but this is not particularly a problem with rEFIt, it's intrinsic to the way firmware password and admin access relate to each other -- if you have either one, you can take control of the other.  For instance, if you have admin access, you can disable or change the firmware password with nvram command,  You can also change the boot volume with System Preferences, effectively bypassing the firmware password protection.

Basically, the firmware password is there to protect the integrity of the computer until the OS starts and can start enforcing its idea of access controls, at which point admin passwords are the relevant control.  Don't think of firmware password as a higher-level control, it's more of a supplement.