Comment by bigfatkitten

> How would it be done externally? Is it done same way as flashing the boot rom?

Depends on the device.

> Is that why you think only foreign intelligence agencies are the ones who can do this?

Because it's enough work that nobody else would bother.

> Also assume that the bios is password protected and it's configured in bios to not boot from a USB drive.

BIOS password is an administrative control. It doesn't stop anyone with the ability to flash firmware from doing anything.