Particularly with firmware, you get chunks to cover bits and pieces but you have to provide certain bits and pieces. I'm frankly shocked how bad the 'ready to go' firmware even from someone like Insyde or AMI is, who you would *think* would have it pretty well down by now. You can have the most milquetoast combination of predictable components and *still* need to do work to behave as well as a Dell or Lenovo even if the components are largely the same, as they have some on staff firmware developers that build on top of the vendors and they don't share their assets with the world. Hell, it's obvious that they don't even share with themselves, some product families are worlds apart from the exact same company with the same chipsets.
A PC has a lot of custom components on it and that's where a lot of the BIOS work comes from.
For example, most PCs need a programmable clock generator to generate the various clock frequencies needed by the CPU, chipset, memory, slots, etc. Did you know there are hundreds of chips out there that can do this? Well, the motherboard manufacturer gets to pick one (and likely a bunch of alternates because supply chain) and put them o the board. But now your BIOS needs to support that chip, so someone needs to write code to support that chip.
But also, there are infinite number of ways to hook that chip up to the various components - many have multiple channels so channel A may go to the CPU, channel B to the RAM, etc., or someone else might do it another way, with Channel A going to RAM, channel B to the chipset, etc.
Likewise, PCIe has two methods of signalling interrupts - an interrupt pin or an interrupt message. Interrupt pins need routing to the interrupt controller, and how that's done is different on every board. Likewise, the interrupt messages are used to have the root complex signal an interrupt on usually another interrupt line.
Then you have the dozens of other controllers - most motherboards have RGB support, which can come in at least 3 different flavors.
There's probably dozens of GPIO lines as well, used to do various things - like vritually set jumpers, write protect the flash chips, and other features.
All those things are something BIOS vendors need to support.
Then there are the fun ones like the ACPI tables (or programs, since it's really a VM like thing). Like when you suspend a PC, you need to start suspending memory, then suspend devices, the CPU, etc. And often toggle various IO lines as you shut down components
Oh, and the BIOS is modular - because someone may want features that someone else doesn't want to pay for.