Yes - for security reasons. Chrome OS has a full verified boot chain, starting from the BIOS, like a smartphone.

You cannot tamper with Chrome OS or access user data without password even with physical access to the device.

None of this works with a 3rd party OS, so you have to disable the secured boot and possible re-flash a different BIOS (similar to unprotecting the bootloader on a phone).

And like most "security reasons" they just take away control from the user and give it to whoever implements that security.

Security against whom, i wonder. The narrative says, against malicious actors, but way more often than not, it ends up being security against the computer's owner.

The procedure to get around the locked bootloader is documented.

For the vast majority of users, a secure by default laptop is a win.

>Chrome OS has a full verified boot chain, starting from the BIOS, like a smartphone. You cannot tamper with Chrome OS or access user data without password even with physical access to the device. [emphasis added]

Ooooh interesting, I'd love to read more about this.

Does this logic apply to iOS as well? (Can't evil maid an iPhone due to verified BIOS?) What about macOS?

iOS has a verified boot chain that you cannot disable, and newer Macs have this too but you can disable it.

One of the things about Chromebooks that make them different is no BIOS altogether, right?

They do have a (customized) UEFI BIOS based on CoreBoot.

CoreBoot, BIOS, and UEFI are alternatives to each other. While you might have firmware that has various compatibility modes, my understanding is that CoreBoot does not provide a BIOS interface at all, and you need the SeaBIOS payload if you want BIOS from CoreBoot.