Isn't the whole point of the T2 chip to prevent these kinds of attacks? The T2 starts the boot process and verifies the integrity of the system (including OS)

Isn't the whole point of the T2 chip to prevent these kinds of attacks? The T2 starts the boot process and verifies the integrity of the system (including OS) and you can't flash the T2 without a digital signature from Apple. Unless someone finds a serious flaw in the system, or one of Apple's signing keys is leaked, I don't see how you'd circumvent it.