People don't have a choice to update their BIOS, as updates like this are automatically installed, by both Windows and the underlying Intel ME tools.

(And I'm trying to avoid talking about microcode updates, which is a whole other story of fuckups)

Regarding Thinkpad BIOS: I have a Raspberry Pi Zero and a self soldered RP2040 programmer [1] in my travel kit for a reason. When travelling, a lot of the Cellebrite rootkits rely on an OEM BIOS, so they typically reflash your BIOS in the "we gonna check your laptop" phase.

[1] would totally recommend serprog, it's awesome: https://codeberg.org/Riku_V/pico-serprog