Re: This wouldn't be (much of) a problem...
>How would that work for tablets, phones, and other sealed hardware where you still want to be able to update the bios occasionally?
A "locked/unlocked" dip switch beside the sim socket doesn't seem unreasonable to me. Unlike the de facto "locking" and "rooting" pantomime.
If these things weren't designed by/for intelligence agencies there'd be dip switches for "radio" and "mic" there too which actually (physically... verifiably!) disabled those circuits.
The truly sealed disposable crap would have to offer the switches along an edge or under covers of course, for the owner's convenience until the battery fails and it's dispatched off to landfill.