There's probably flaws that would allow executing attacker supplied code, but it's not like BIOSs had any notion of security (i.e. secure boot) to begin with, so you could just straight up have the system boot into your own image anyway.