Right, but I'm still surprised they've not at least implemented "if can't read EEPROM at boot disable EEPROM writes". With the architecture used, they're never

Right, but I'm still surprised they've not at least implemented "if can't read EEPROM at boot disable EEPROM writes". With the architecture used, they're never going to be too robust to physical access. Overall EEPROM reset button on motherboard would be best, and just admit there's no really security against physical access here.