There's a discussion in r/netsec right now about The Evil Maid problem. Looking at the datasheet for a common eeprom (24c256 http://www.techdesign.be/projects/datasheet/24LC256.pdf), the write protect pin is active high, and has an internal pull-down to GND. For a motherboard that has a physical write-protect or something like that, it'd be relatively straightforward for the Evil Maid to cut the WP pin to the eeprom to re-enable writes to it.

That makes me said. If it were the other way around (pull to VCC to enable writes), you'd at least need to add a pretty obvious bodge wire to the WP pin to enable writes.