PowerPC Macs (in the 2000s, before the switch to Intel) did indeed require a manual step to update Boot ROM/firmware - a different mechanism than resetting the PRAM. You'd run the installer, then either shut down or reboot the Mac. As it booted, you'd either hold down the power button or the interrupt button (depending on the model) to initiate the update.
This reminds me of the hardware switch in the original Chromebook, the cr-48, which requires you to flip a switch underneath a piece of tape before you can install an alternative operating system.
Actually, Chromebooks should be the most secure laptop platform nowadays, since every Chromebook has signed binaries and to enter in developer mode, you need some kind of switch so you can overwrite your bootloader.
Of course, this is assuming Chromebooks' bootloader doesn't have any secured problems.
Assuming that the signing key hasn't been compromised and added to an attacker's collection of keys, which is something certain three letter agencies have a habit of doing.