"Only if you're using the TPM, because otherwise you have no means of validating that the firmware isn't now lying to you."

Can't changing firmware be prevented even without the TPM, by a simple password check? Most laptops seem to have the ability to lock bios down.