I had a chromebook which required you to open it up and flip a hardware switch to allow write access to the OS. Have to open it up and push the switch with a little screwdriver.
That's probably the best way to "lock down" a machine while also keeping it in use after the manufacturer decides that it's not worth their time to support. Lock it down for most people, but unlock it for those who know what they're doing.
I had a Asus Chromebox that did this and I actually always thought it was a good compromise. Still let me install my own OS with minimal hassle (case was well designed, screw was easy to get to), but normal users can get the security of a locked down bootloader.
Ah yes, that was it; a screw. Asus C201 or something like that
My pixelbook is the same way. However, I custom made a debug cable so I wouldn't have to pull the battery out which often destroys it because of all the adhesives they use