Chromebooks did this for a while; they had a write-protect screw on the motherboard that had to be removed to enter developer mode and/or flash custom firmware. Once you were done, you could reinsert the screw to lock it back down again.
[1] https://wiki.mrchromebox.tech/Firmware_Write_Protect
[2] https://chromium.googlesource.com/chromiumos/third_party/hdc...
It’s amusing, because back in the 80’s we used to have a saying: “Beware of programmers who carry screwdrivers.”