It doesn't even need to be that. Expose it on a header on the motherboard so end users can add/remove a jumper. Same as should be in place for the write enable pin on the system's firmware EEPROM. The fact that the end user has no way to prevent firmware updates on most motherboards is a fucking travesty.

Businesses can simply tell their employees to leave it enabled or find another job.