It’s largely down to security economics. Boot ROMs can eventually be bypassed although difficult. But the real goal is actually to make it difficult enough such

It’s largely down to security economics. Boot ROMs can eventually be bypassed although difficult. But the real goal is actually to make it difficult enough such that you require physical access, specialised equipment and knowledge in order to pull it off - essentially making sure attacks are difficult to scale.