As in another post, I’d suggest buying any router, taking it apart, identifying the flash chip, find the write-enable line in the data-sheet and MITM that line with a flip switch to block updates at all times.
Then they got rid of that, even though most people that bothered with BIOS updates could be directed to switch a jumper around...