On my newest laptop, an Asus Zenbook A16, the BIOS (a Insyde 309 3.08) has NO way to disable USB boot or even to change the boot priority. I enabled a BIOS password, secure boot, and a Bitlocker PIN (so my computer boots into a special boot screen before Bitlocker is unlocked) but I'm still not sure if this is enough.