If they wanted to lock it down they could have just used coreboot and didn't build a big honking framework deliberately designed to allow running different syst

If they wanted to lock it down they could have just used coreboot and didn't build a big honking framework deliberately designed to allow running different systems that have no pre-existing knowledge about the machine. Just like many other closed platforms of yore, or how in practice Macs of today work (their UEFI is, plainly, not to spec - a lot of hackintosh work is figuring out "what Apple did wrong this time")