That BIOS feature can be disabled.... now. But there's nothing keeping a manufacturer from just not providing that functionality, and requiring only signed firmware updates. Now the machine is more or less locked down.

The fact it can be disabled now is a convenience feature based on historical availability, but that's absolutely no guarantee it will continue to be there in the future.