Not quite. Weakness is later in the chain.

Secure second-stage loader (BL2) loads secure third-stage loader (BL31) from insecure flash storage, then verifies it by calculating SHA-256 hash of it and comparing that to the value stored in the same insecure flash.