I was helping a friend replacing the battery and thermal paste on his System 76 laptop. Never own one before but I notice it runs a special BIOS version, Coreboot. It turns out there are Coreboot and Lireboot. .These help to boot really fast though.
Anyway, I notice there are no password BIOS lock like on Lenovo. How would this protect against someone plug a USB in and just wipe my drive? On Lenovo you can set a supervisor / boot passwords, and you can remove USB drives from the boot list.
In the best possible scenario, a BIOS/UEFI password lock will prevent an adversary from using the computer as-is. If the adversary has an objective to quickly fence the computer, then this objective is foiled. Note that preventing the computer from physical access would also foil this objective, since that prevents the adversary from even accessing the machine.
But that’s the best case. In a more-worse case scenario, the adversary wants to steal data from the computer. A firmware password will be useless if the adversary removes the HDD or SSD from the machine. This is, instead, correctly solved with drive-level encryption, using a password or smart card to unlock.
The reason why open-source firmwares (BIOS/UEFI) might be uninterested in implementing a password is because: 1) preventing physical access is more effective, and 2) because it’s arguably a form of security theatre: commercial firmware vendors include a password feature because some customer once asked for it, but not with security as a well-thought objective. Open-source projects have a habit of not implementing pointless features.
TL;DR: physical access to a machine is fatal to any and all security protections