Re: Observations
ROM based OS can be as permanent or as upgradeable as you like. For example the EAROM (Electrically Alterable ROM) can be reprogrammed by enabling a special hardware signal, while Acorn made the ROM physically swappable and distributed OS upgrades by sending out a replacement chip. The BIOS in the average desktop PC faces similar issues but is mostly a lot more easily updated - and hence a lot more easily hacked.
An OS in ROM is not a panacea for all ills, but it helps finesse security management.