The only one who can lock the boot process is the device owner: school/company laptops might be locked down and they might not bother resetting that.

By default it's locked-but-user-unlockable (presence test, user data removal), with various levels of trade-offs between "degrees of freedom to replace stuff" vs. "ability to recover without external hardware tools". When user and owner differ (e.g. schools or companies), the owner gets to decide.

As for source code, go wild: https://review.coreboot.org/plugins/gitiles/coreboot/+/refs/...