Depends on the device.
> Is that why you think only foreign intelligence agencies are the ones who can do this?
Because it's enough work that nobody else would bother.
> Also assume that the bios is password protected and it's configured in bios to not boot from a USB drive.
BIOS password is an administrative control. It doesn't stop anyone with the ability to flash firmware from doing anything.
BIOS password does help if they need to be able to boot from usb drive to flash firmware. Or do you know another way? Again, not talking about boot rom.
If you ask extremely general questions, you're going to get extremely general answers. This is a discussion board, not a personal research service. You need to go and figure this out for the specific hardware you are concerned about.
> BIOS password does help if they need to be able to boot from usb drive to flash firmware.
That's the only circumstance in which it helps, but that's rarely necessary on modern machines.
They are not all built the same. It depends on the SPECIFIC device.