> "depends on the device" is almost not an answer at all.
If you ask extremely general questions, you're going to get extremely general answers. This is a discussion board, not a personal research service. You need to go and figure this out for the specific hardware you are concerned about.
> BIOS password does help if they need to be able to boot from usb drive to flash firmware.
That's the only circumstance in which it helps, but that's rarely necessary on modern machines.
https://en.m.wikipedia.org/wiki/Fwupd