This implies that the bios can be corrupted - the bios shouldn't accept unsigned updates (without an in bios flag being switched first), even from a root-level

This implies that the bios can be corrupted - the bios shouldn't accept unsigned updates (without an in bios flag being switched first), even from a root-level user on the OS.