Chromebooks are close but one should be able to keep their changes and reactivate the security screw so no further changes maybe made. Simply, manual switches to protect UEFI/BIOS and TPM changes are better move then none or all approach the Chromebooks take.