This doesn't need manufacturer intervention... look at secure boot as it is on x86. You have the option of enrolling your own keys, or not doing it, and can lock down the BIOS. If using a TPM then you get okay assurance that the OS has not been tampered with.

Sure, there are exploits for these things, just as there are exploits for iOS.