Are you certain Chromebooks have a read-only BIOS? They recently shipped firmware updates to fix a widespread TPM vulnerability.[1]
[1] https://www.chromium.org/chromium-os/tpm_firmware_update#TOC...
[1] https://www.chromium.org/chromium-os/tpm_firmware_update#TOC...
https://www.chromium.org/chromium-os/developer-information-f...