I'd assume that their promise (https://puri.sm/posts/pioneering-cpu-efforts-to-liberate-lap...) to "ship with an Intel CPU fused to run unsigned BIOS code" means precisely that they leave Boot Guard disabled.

Which is much less than they market it, but that's part of the issue some people in the coreboot community have with Purism. They present it as some groundbreaking success (while it's nothing but clicking a different checkbox in a tool), and I really doubt it's the "first [laptop] to ship" that way. Chromebooks come to mind.