AFAIK there are signatures that are checked at the SoC level. In other words, it's not a write lock that can be bypassed by flashing the chips directly.