I think for the subset of people that care about having AVX512 on their 12900K, and bother to disable the E-cores to achieve it, they will be using enthusiast motherboards that don't block bios upgrades in this way.
Microcode downgrades are blocked by the CPU itself; the BIOS doesn't get a say. You could downgrade the whole BIOS to stop the upgrade being applied on boot (maybe, some motherboards may try to block this too), but then you need to choose between uncrippled microcode and BIOS bugfixes and improvements.