Depends on the device.
> Is that why you think only foreign intelligence agencies are the ones who can do this?
Because it's enough work that nobody else would bother.
> Also assume that the bios is password protected and it's configured in bios to not boot from a USB drive.
BIOS password is an administrative control. It doesn't stop anyone with the ability to flash firmware from doing anything.
BIOS password does help if they need to be able to boot from usb drive to flash firmware. Or do you know another way? Again, not talking about boot rom.
If you ask extremely general questions, you're going to get extremely general answers. At the end of the day this is a discussion board, not a personal research service. You need to go and figure this out for the specific hardware you are concerned about.
> BIOS password does help if they need to be able to boot from usb drive to flash firmware.
That's the only circumstance in which it helps, but that's rarely necessary on modern machines.
They are not all built the same. It depends on the SPECIFIC device.
You could flash coreboot and run your own secure boot chain etc on one machine, but this is absolutely not something you can do at organisational scale.
That said, only individuals worried about foreign intelligence services need to incorporate this into their threat model.