Well first you need to compromise a machine. Game over there and then, let alone starting to re-flash BOIS or whatever - this is just another *thing* that can be changed once you own the machine. No big surprise there.
Of course, as to your question - if you have physical access (and a black hat), then game over anyway.
So you need admin and be able to install a dodgy kernel module to trash the machine. Then again, if you got that far, a 2lb hammer would suffice without needing to know anything about computers/kernels/modules.