As long as in-device firmware is modifiable and the protection relies on lack of bugs in its implementation, then I'm not in agreement. What I have in mind is

As long as in-device firmware is modifiable and the protection relies on lack of bugs in its implementation, then I'm not in agreement. What I have in mind is just a fixed boot order enforced by firmware stored in ROM, where external storage takes priority, and where you can easily control external storage. (as easy as inserting a uSD card) All the TF-A, bootloader, kernel is loaded from the external storage, so no software at all is loaded from any modifiable storage that's part of the device itself, if you don't want to. Any attacker made changes to the software on the storage inside the device would be irrelevant. Such setup seems much better than having to assume no bugs in existing firmware or HW related to secure boot, etc.