It's a lot easier to escalate a binary drop into a persistent threat if it can reflash the BIOS with compromised firmware. Requiring firmware be signed prevents

It's a lot easier to escalate a binary drop into a persistent threat if it can reflash the BIOS with compromised firmware. Requiring firmware be signed prevents this, at the cost of also preventing the use of coreboot, libreboot et al. In theory, it should be possible to support user flashing of unsigned firmware, perhaps in some sort of OS-less boot mode that malware couldn't use. But offering that capability without it being a backdoor is costly and effortful enough that I don't really blame motherboard manufacturers for declining to do so on behalf of a rather niche use case.